jspanda

JSPanda JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code. However, JSpanda cannot detect advanced prototype pollution vulnerabilities. How JSPanda works? Uses...

AutoBrowser

AutoBrowser 4.0 AutoBrowser is a tool written in python for penetration testers. The purpose of this tool is to create reportJson file and screenshots of http/s based ports on the network. you can choose between analyze Nmap reportXML file -oX or scan with Nmap, then the tool automaticly Check th...

camoufox

Camoufox Camoufoxは、WebスクレイピングとAIエージェントのために作られたオープンソースのアンチ検出ブラウザです。🦊 ⚠️ このプロジェクトは開発中です。安定した本番環境での使用には適さない可能性があります。⚠️ !NOTE 最新のドキュメントはすべてcamoufox.com で入手できます。 スポンサー すべて表示/折りたたむ プレミアム はじめに...

phishcollector

PhishCollector PhishCollector는 피싱 사이트를 수집, 분석 및 추적하기 위한 연구 프레임워크 입니다. 이 프레임워크는 의도적으로 시작점으로 설계되었습니다. 탐지 규칙, 기술 시그니처, 단어 목록 및 플러그인은 모두 일반 데이터 구조로 되어 있어, 연구자들이 읽고, 확장하고, 자신의 위협 환경에 맞게 조정할 수 있습니다. 의심스러운 URL을 제출하면 PhishCollector는 다음을 수행합니다: 헤드리스 Chromium 브라우저JavaScript 활성화, 무작위 User-Agent, 스텔스 안티봇 조치에...

vi-bot

BotDetect v2 — 프로덕션 봇 탐지 라이브러리 클라이언트 측 봇 및 자동화 탐지 라이브러리로, 가중치 기반 점수 산정, 행동 분석, 브라우저 지문 인식, 설정 가능한 임계값을 제공합니다. 헤드리스 브라우저, Selenium, Puppeteer, Playwright, CDP 기반 도구, 스텔스 자동화 프레임워크를 탐지합니다. v2.1.0 — 탐지 방지 허니팟, GPU 안정적 캔버스 지문 인식, 향상된 행동 분석, 지연 초기화, 서버 측 변조 탐지, 요청 지문 바인딩, 속도 제한. 목차 기능 아키텍처 빠른 시작 클라이언트...

react2shell-checker

React2Shell チェッカー Next.js および React アプリケーションにおける React2Shell の脆弱性 CVE-2025-55182 を検出するセキュリティ脆弱性スキャナーです。 概要 React2Shell チェッカーを使用すると、Web サイトをスキャンして、Next.js または React Server Components の脆弱性が存在するバージョンを実行しているかどうかを検出できます。このツールはヘッドレスブラウザ技術を使用してフレームワークのバージョンを検出し、既知の脆弱性のあるバージョン範囲と比較します。 機能 🔍 自動検出 —...

ROS-20260911-73-0236

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...

ROS-20260908-73-0103

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge relates to reading data from buffer areas beyond their permitted limits. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge, which allows a hacker to trigger a service failure

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...

CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

EUVD-2026-51545

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

CVE-2026-59231: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

EUVD-2026-50632

Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-52843

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials,...

EUVD-2026-44720

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

CVE-2026-52843

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials,...

PT-2026-60226

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

CVE-2026-52842: Origin Validation Error

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated...

CVE-2026-61429

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial...

CVE-2026-61429 PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial...