8799 matches found
CVE-2026-75931
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...
Codify-TJNULL-OSCP-
Hack The Box — Codify Writeup Vollständiger Penetrationstest-Walkthrough und Writeup für die Maschine Codify auf Hack The Box. 📌 Maschineninfo Feld| Wert ---|--- Name| Codify Betriebssystem| Linux Schwierigkeitsgrad| Einfach Kernkonzepte| vm2 RCE CVE-2023-30547, SQLite-DB-Enumeration,...
TarantuBench
TarantuBench v1 Ein Benchmark zur Bewertung von KI-Agenten bei Web-Sicherheitsherausforderungen, generiert von der TarantuLabs-Engine. Was ist das? TarantuBench ist eine Sammlung von 100 angreifbaren Webanwendungen, die jeweils eine versteckte Flagge TARANTU... enthalten. Die Aufgabe eines Agente...
crlfi-scanner
CRLFISCANNER CRLFISCANNER è uno strumento CLI professionale Node.js per rilevare vulnerabilità di CRLF Injection inviando richieste HTTP basate su payload, analizzando gli header di risposta e, opzionalmente, segnalando i risultati a un bot API/Telegram. 🎯 Che cos'è CRLFISCANNER? CRLFISCANNER è u...
gitlab-profile
STATO TEST : ↳ tester core-orchestrator ↳ tester documentazione DATA DI CREAZIONE: 2025-10-24 09:50 PM ↳ Alberto Marangelo - @theGlitched !WARNING ⚠️ Questo progetto è in beta! 🎉 sì! Siamo felici di annunciare che la versione beta sarà presto completa! Dalla versione 0.153 sono attualmente avviati...
External Control of File Name or Path
Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read arbitrary files...
CVE-2026-78208
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...
CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...
CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...
EUVD-2026-64683
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...
CVE-2026-33937
CVE-2026-33937 — Handlebars.js AST Injection RCE Betroffen sind die Handlebars.js-Versionen 4.0.0 bis 4.7.8. CVSS-Score: 9.8 Kritisch. Übersicht CVE-2026-33937 ist eine Type-Confusion-Schwachstelle in Handlebars.js. Die Funktion Handlebars.compile akzeptiert als Eingabe sowohl eine...
CVE-2025-59528-PoC
CVE-2025-59528 PoC zu Bildungszwecken Nur zu Bildungszwecken. Dieses Projekt ist für kontrollierte Sicherheitsforschung, Demonstrationen im Unterricht und autorisierte Tests in einer isolierten Laborumgebung vorgesehen. Verwenden Sie es nicht gegen Systeme, Netzwerke, Anwendungen oder Konten, die...
XSLeaker
XSLeaker XSLeaker é uma ferramenta que ajuda a encontrar XS-Leaks em websites. A ferramenta compara valores de recursos para os quais uma técnica de vazamento é conhecida ex.: número de iframes entre diferentes estados. XSLeaker consiste em dois componentes: uma extensão do Chrome que é usada par...
CVE-2026-73566
creationtimestamp| type| source ---|---|--- 2026-08-21 20:35:04+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m 2026-08-22 12:00:51+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa2m3bdg2n...
EUVD-2026-63829
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...
CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...
CVE-2026-74866
@fastify/busboy (a multipart form-data parser for Node.js) is vulnerable to CRLF injection via the Content-Disposition filename and field name. The part-header parser splits lines only on the two-byte CRLF sequence, so a lone carriage return or line feed embedded in a part header is carried verba...
Malicious code in @next-fonts/font (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...
CVE-2026-72861
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...