cli

CloudGraph — это бесплатный универсальный инструмент с открытым исходным кодом для GraphQL API и управления положением безопасности в облаке CSPM для AWS, Azure, GCP и K8s. С CloudGraph вы получаете: Бесплатные и простые проверки соответствия например, Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, A...

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

CVE-2025-56643

CVE-2025-56643 Общедоступная ссылка на CVE-2025-56643 – Уязвимость сессии JWT в Wiki.js 2.5.307 Описание: Requarks Wiki.js 2.5.307 не выполняет надлежащий отзыв или аннулирование активных JWT-токенов при выходе пользователя из системы. В результате ранее выданные токены остаются действительными и...

GraphQLer

The only dependency-aware GraphQL API testing tool! GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on adaptability. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs. GraphQLer...

CVE-2024-37843-POC

CVE-2024-37843-POC CVE-2024-37843 的 POC。Craft CMS 基于时间盲注 SQL 注入 详情见博客 POC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON assets.id =...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Nuclei 템플릿 CVE-2026-19478 에 대한 비파괴적 Nuclei 탐지 템플릿입니다. 이 취약점은 GitLab GraphQL API의 인증되지 않은 임의 메서드 호출 결함으로, 심각도CVSS 9.4 등급이며 GitLab에서 2026년 8월 17일 에 패치했습니다. TL;DR GitLab의 GraphQL 스키마는 필드를 특정 최소 GitLab 버전으로 제한하는 @glintroducedversion: "X.Y.Z" 디렉티브를 지원합니다. 디렉티...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - Перечисление пользователей GitLab GitLab — это широко используемый веб-инструмент для жизненного цикла DevOps, предоставляющий менеджер Git-репозиториев со встроенными функциями непрерывной интеграции, отслеживания проблем, проверки кода и многим другим. GraphQL API — это мощный...

CVE-2021-4191_Exploits

CVE-2021-4191Exploits pip install python-graphql-client Использование: python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql Авторские права: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-18885

CVE-2026-18885 is a code injection vulnerability in the ServiceNow AI platform , specifically in its GraphQL Composite Data API , enabling an unauthenticated attacker to execute arbitrary code and access or modify instance data. The CVSS 4.0 base score is 10.0 (Critical) with all impact dimension...

CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

EUVD-2026-63683

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...