5588 matches found
nodejshell
NODEJSHELL - Reverse shell exploit for NodeJs deserialization CVE-2017-5941 The exploit automatically generates the reverse shell payload which is encoded in decimal and then in base64. After that, this payload is sent via an HTTP POST request that serializes the user input and stores it in a...
htcap
HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...
witcher
witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...
XploitSPY
A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...
dvna
Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...
Node.js st module Directory Traversal
A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792746902)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792746902 advisory. - This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to hasanfleyah for reporting this vulnerability and thank you...
0xsp-Mongoose
Support the project for continuous development ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 0xsp Mongoose RED for Windows Current Release 2.2.0 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted...
Node.JS System Information Library <5.3.1 - Remote Command Injection
Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...
PT-2026-121688
@MarkusEicher70 MacMarkus, as you are asking, here a stupid question The list below looks complete, but something is missing! For sure! CVSS=9.2 October 21st 2026 1. PHP Engine vulerability – "PHP2Shell" CVE-2026-109618 and CVE-2026-109619 Patched Versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35...
GHSA-8R9P-F939-6H3C vulnerabilities
Vulnerabilities for packages: lerna, semaphore, commercial-gitlab-rails-ee-fips, wazuh-dashboard-fips, homepage, azurite, kubeflow-pipelines, lambda-nodejs, kibana, prism, langfuse-fips, code-server, nextcloud-server, unleash-fips, gitlab-rails-ce, configurable-http-proxy, redisinsight,...
CVE-2026-111755 vulnerabilities
Vulnerabilities for packages: lerna, semaphore, commercial-gitlab-rails-ee-fips, wazuh-dashboard-fips, homepage, azurite, kubeflow-pipelines, lambda-nodejs, kibana, prism, langfuse-fips, code-server, nextcloud-server, unleash-fips, gitlab-rails-ce, configurable-http-proxy, redisinsight,...
CVE-2026-111756 vulnerabilities
Vulnerabilities for packages: lerna, semaphore, commercial-gitlab-rails-ee-fips, wazuh-dashboard-fips, homepage, azurite, kubeflow-pipelines, lambda-nodejs, kibana, prism, langfuse-fips, code-server, nextcloud-server, unleash-fips, gitlab-rails-ce, configurable-http-proxy, redisinsight,...
GHSA-Q3JH-WRC6-JGQ8 vulnerabilities
Vulnerabilities for packages: lerna, semaphore, commercial-gitlab-rails-ee-fips, wazuh-dashboard-fips, homepage, azurite, kubeflow-pipelines, lambda-nodejs, kibana, prism, langfuse-fips, code-server, nextcloud-server, unleash-fips, gitlab-rails-ce, configurable-http-proxy, redisinsight,...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the checkServerIdentity function in lib/tls.js. An attacker can bypass certificate hostname checks by getting a TLS client to connect using fullwidth digits representing an IPv4...
CLEANSTART-2026-YO77738 HTTP request smuggling in Node
Security vulnerability affects the nodejs-24 package. HTTP request smuggling in Node...
CLEANSTART-2026-XE23259 Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Security vulnerability affects the nodejs-24 package. Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...
CLEANSTART-2026-OM41061 Improper Certificate Validation in Node
Security vulnerability affects the nodejs-24 package. Improper Certificate Validation in Node...