CVE-2026-108742

CloudBeaver versions through 25.3.5 are vulnerable to a missing authorization flaw in the initConnection GraphQL mutation . This allows members with only view-only shared-project access to persist credentials without the required datasource-edit permission. An attacker can set the saveCredentials...

CVE-2026-108742 CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

EUVD-2026-96908

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

graphw00f

Créditos para Nick Aleks pelo logotipo! graphw00f - Identificação de Servidores GraphQL Índice Como funciona? Detecções Matriz de Ameaças GraphQL Pré-requisitos Instalação Configuração Exemplo de Uso Identificação de GraphQL Detecção e Identificação de GraphQL Suporte e Problemas Recursos Como...

cli

CloudGraph ist das kostenlose Open-Source universelle GraphQL-API und Cloud Security Posture Management CSPM-Tool für AWS, Azure, GCP und K8s. Mit CloudGraph erhalten Sie: Kostenlose und mühelose Compliance-Prüfungen z.B. Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, AWS CIS 1.3, AWS CIS 1.4, AWS PC...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

graphicator

Graphicator Graphicator ist ein GraphQL-"Scraper" / Extraktor. Das Tool durchläuft das vom anvisierten GraphQL-Endpunkt zurückgegebene Introspections-Dokument, strukturiert das Schema dann in eine interne Form um, sodass es die unterstützten Abfragen neu erstellen kann. Sobald solche Abfragen...

inql

InQL v6.1.2 – Burp-Erweiterung für fortgeschrittene GraphQL-Tests !Doyensec Research...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

resterm

Resterm Um workbench de API-as-code para o terminal. resterm.app · docs Resterm é um cliente de API que usa arquivos .http/.rest como código-fonte. Quase todos os recursos ficam nos arquivos .http, então são fáceis de revisar no Git ou em qualquer outro sistema de controle de versão. Você pode...

CrackQL

CrackQL CrackQL ist ein GraphQL-Passwort-Brute-Force- und Fuzzing-Werkzeug. CrackQL ist ein vielseitiges GraphQL-Penetrationstest-Werkzeug, das schlechte Ratenbegrenzungs- und Kostenanalyse-Kontrollen ausnutzt, um Anmeldeinformationen zu erraten und Operationen zu fuzzen. Inhaltsverzeichnis...

graphql-threat-matrix

GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...

graphql-threat-matrix

GraphQL Threat Matrix Warum graphql-threat-matrix? graphql-threat-matrix wurde für Bug-Bounty-Jäger, Sicherheitsforscher und Hacker entwickelt, um Schwachstellen in verschiedenen GraphQL-Implementierungen aufzudecken. Die Unterschiede in der Interpretation und Einhaltung der GraphQL-Spezifikation...

batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

batchql

BatchQL BatchQL é um script de auditoria de segurança GraphQL com foco em realizar consultas e mutações GraphQL em lote. Este script não é complexo, e recebemos melhorias de bom grado. Ao explorar o espaço do problema de ataques de lote GraphQL, descobrimos que existiam algumas postagens em blogs...

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure

GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2020-26413 info:...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...