5588 matches found
reconness
ReconNess Web App Why ReconNess? Well, we have seen a lot of bugbounty hackers organizing his recon using txt and doing a lot of bash scripts to filter the output to keep everything organized with the intention to focus only on the potentially vulnerable targets. But realistically this demands a...
Reverse_HTTPS_Bot
ReverseHTTPSBot 0.8 Description: A python based https remote access trojan for penetration testing. Server is currently NodeJS based Bot Requires: pip install requests pip install pyscreenshot Server Requires: sh setup.sh to generate self signed certificate and key for testing sudo npm install...
Nodejs Squirrelly - Remote Code Execution
Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...
Lodash Template - Server-Side Template Injection (RCE)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...
nodejshell
NODEJSHELL - Reverse shell exploit for NodeJs deserialization CVE-2017-5941 The exploit automatically generates the reverse shell payload which is encoded in decimal and then in base64. After that, this payload is sent via an HTTP POST request that serializes the user input and stores it in a...
htcap
HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...
Node.js st module Directory Traversal
A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792746902)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792746902 advisory. - This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to hasanfleyah for reporting this vulnerability and thank you...
0xsp-Mongoose
Support the project for continuous development ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 0xsp Mongoose RED for Windows Current Release 2.2.0 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted...
Node.JS System Information Library <5.3.1 - Remote Command Injection
Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...
PT-2026-121688
@MarkusEicher70 MacMarkus, as you are asking, here a stupid question The list below looks complete, but something is missing! For sure! CVSS=9.2 October 21st 2026 1. PHP Engine vulerability – "PHP2Shell" CVE-2026-109618 and CVE-2026-109619 Patched Versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35...
CVE-2026-111755 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, kubeflow-pipelines, langfuse-fips, prism, langfuse, azurite, nextcloud-server, redisinsight, lambda-nodejs, homepage, configurable-http-proxy, code-server, semaphore, commercial-gitlab-rails-ee-fips,...
GHSA-8R9P-F939-6H3C vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, kubeflow-pipelines, langfuse-fips, prism, langfuse, azurite, nextcloud-server, redisinsight, lambda-nodejs, homepage, configurable-http-proxy, code-server, semaphore, commercial-gitlab-rails-ee-fips,...
CVE-2026-111756 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, kubeflow-pipelines, langfuse-fips, prism, langfuse, azurite, nextcloud-server, redisinsight, lambda-nodejs, homepage, configurable-http-proxy, code-server, semaphore, commercial-gitlab-rails-ee-fips,...
GHSA-Q3JH-WRC6-JGQ8 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, kubeflow-pipelines, langfuse-fips, prism, langfuse, azurite, nextcloud-server, redisinsight, lambda-nodejs, homepage, configurable-http-proxy, code-server, semaphore, commercial-gitlab-rails-ee-fips,...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the checkServerIdentity function in lib/tls.js. An attacker can bypass certificate hostname checks by getting a TLS client to connect using fullwidth digits representing an IPv4...
CLEANSTART-2026-XE23259 Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Security vulnerability affects the nodejs-24 package. Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...
CLEANSTART-2026-OM41061 Improper Certificate Validation in Node
Security vulnerability affects the nodejs-24 package. Improper Certificate Validation in Node...