CVE-2026-34220

CVE-2026-43220 حقن SQL في MikroORM ★ إثبات مفهوم حقن SQL في MikroORM CVE-2026-43220 ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 نظرة عامة CVE-2026-43220 هو ثغرة حقن SQL في MikroORM ، وهو إطار عمل ORM شائع الاستخدام في TypeScript/Node.js. عندما يتم تمرير قيمة...

crlfi-scanner

CRLFISCANNER CRLFISCANNER هي أداة احترافية بواجهة سطر أوامر CLI مبنية بلغة Node.js لاكتشاف ثغرات حقن CRLF CRLF Injection عن طريق إرسال طلبات HTTP قائمة على الحمولات، وتحليل ترويسات الاستجابة، والإبلاغ الاختياري عن النتائج إلى خدمة API أو بوت تيليجرام. 🎯 ما هي أداة CRLFISCANNER؟ CRLFISCANNER هي أد...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

CVE-2025-66478-Research-Proof-of-Concept

CVE-2025-66478-अनुसंधान-प्रमाण-अवधारणा अवलोकन इस रिपॉजिटरी में CVE-2025-66478 से संबंधित अनुसंधान और एक प्रमाण-अवधारणा कार्यान्वयन शामिल है, जो कुछ Next.js / React Server Components कॉन्फ़िगरेशन को प्रभावित करने वाली कमजोरी है। यह परियोजना शैक्षिक और रक्षात्मक सुरक्षा उद्देश्यों के लिए नियंत्रित...

jscd

jscd Rétro-ingénierie des fichiers .jsc compilés par bytenode vers JavaScript. Analyse statique uniquement : un binaire pur Rust — pas de V8 patché, pas de runtime Node, pas de réseau. Prend en charge Node 8.0.0 → 26.10.0 510 versions / 36 mineures V8 ; ≈ 25k fichiers.jsc passent les tests avec 0...

CVE-2026-44578-next-js-ssrf

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF مختبر مختبر مستقل لإعادة إنتاج الثغرة الأمنية CVE-2026-44578 CWE-918، SSRF في تطبيقات Next.js ذات الاستضافة الذاتية التي تستخدم خادم Node.js المدمج. الحقل| القيمة ---|--- CVE| CVE-2026-44578 GHSA| GHSA-c4j6-fc7j-m34r CVSS 3.1| 8.6 HIGH...

Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

MAL-2026-17560 Malicious code in hardhat-spack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns...

CVE-2017-16082

CVE-2017-16082 نظرة عامة الإصدارات المتأثرة من pg تحتوي على ثغرة تنفيذ التعليمات البرمجية عن بُعد تحدث عندما تحدد قاعدة البيانات أو الاستعلام اسم عمود مُصمَّم. يوجد سيناريوهان محددان يحتمل أن يكون التطبيق فيهما عرضة للثغرة: 1. ينفذ التطبيق استعلامات SQL غير آمنة مقدمة من المستخدم تحتوي على أسماء...

ALSA-2026:75864 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

PT-2026-106198

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.0 Description Ghost is a Node.js content management system. When using the default local storage adapter, the system fails to restrict the content type of uploaded files. This allows files uploaded by staff...

CVE-2026-105650: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulti...

CVE-2026-105643: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...

CVE-2026-105644: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...

The vulnerability of the Node.js software platform’s HTTP agent allows attackers to compromise the integrity of protected information.

The vulnerability of the Node.js software platform’s HTTP agent is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

The vulnerability of the vulnerabilityCheck() function in the parseEnv component of the simple-git library on the Node.js programming platform allows a hacker to bypass existing security mechanisms.

The vulnerability of the vulnerabilityCheck function in the parseEnv component of the simple-git library in the Node.js software platform is related to the use of an incomplete blacklist. Exploitation of this vulnerability could allow a malicious actor to bypass existing security mechanisms...

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...

MAL-2026-17473 Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

MAL-2026-17484 Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

CVE-2025-55182

CVE-2025-55182 React Server Components में दूरस्थ कोड निष्पादन भेद्यता CVE-2025-55182 और Next.js में दूरस्थ कोड निष्पादन भेद्यता CVE-2025-66478, यह भेद्यता मुख्य रूप से react-server-dom-webpack के Server Actions फीचर को प्रभावित करती है। क्लाइंट द्वारा प्रस्तुत फॉर्म को पार्स करते समय सुरक्षा जां...