CVE-2025-56643

CVE-2025-56643 Общедоступная ссылка на CVE-2025-56643 – Уязвимость сессии JWT в Wiki.js 2.5.307 Описание: Requarks Wiki.js 2.5.307 не выполняет надлежащий отзыв или аннулирование активных JWT-токенов при выходе пользователя из системы. В результате ранее выданные токены остаются действительными и...

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

GraphQLer

Единственный инструмент тестирования GraphQL API с учётом зависимостей! GraphQLer — это передовой инструмент, предназначенный для динамического тестирования GraphQL API с акцентом на адаптивность. Он предлагает ряд сложных функций, которые упрощают процесс тестирования и обеспечивают надёжный...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

CVE-2024-37843-POC

CVE-2024-37843-POC POC для CVE-2024-37843. Слепая time-based SQL-инъекция в Craft CMS Подробности доступны в блоге POC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN...

cli

CloudGraph — это бесплатный универсальный инструмент с открытым исходным кодом для GraphQL API и управления положением безопасности в облаке CSPM для AWS, Azure, GCP и K8s. С CloudGraph вы получаете: Бесплатные и простые проверки соответствия например, Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, A...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — шаблон Nuclei Неразрушающий шаблон обнаружения Nuclei для CVE-2026-19478 — критической CVSS 9.4 неаутентифицированной уязвимости произвольного вызова методов в GraphQL API GitLab, исправленной GitLab 17 августа 2026 года. TL;DR Схема GraphQL в GitLab...

CVE-2026-4523

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523

GitLab CE/EE is affected by a missing authorization vulnerability in the GraphQL API (specifically the CI job trace API). Under certain conditions, this flaw could allow an unauthenticated user to read CI/CD job trace contents , potentially exposing sensitive variable values . The issue impacts v...

EUVD-2026-88690

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

FreeBSD: VID-3f11e437-b7cd-11f1-a883-2cf05da270f3 (CVE-2026-4523): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

GitLab 15.11 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-4523)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600

FreePBX, an open-source IP PBX, is vulnerable to Host Command Injection in versions prior to 17.0.9 . The vulnerability exists in the GraphQL api module's documentation generator , which accepts an authenticated host parameter and incorporates it into a shell command without proper validation or ...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - Перечисление пользователей GitLab GitLab — это широко используемый веб-инструмент для жизненного цикла DevOps, предоставляющий менеджер Git-репозиториев со встроенными функциями непрерывной интеграции, отслеживания проблем, проверки кода и многим другим. GraphQL API — это мощный...