XploitSPY

A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...

ninjasworkout

취약한 NodeJS 애플리케이션 빠른 시작 Download the Repo = run npm i 모든 의존성을 설치한 후 다음을 실행하세요 node app.js or nodemon app.js 추가된 취약점 프로토타입 오염 ✅1 NoSQL 인젝션 ✅2 크로스 사이트 스크립팅 ✅3 취약한 접근 제어 ✅4 취약한 세션 관리 ✅5 취약한 정규 표현식 구현 ✅ 6 경쟁 조건 ✅7 CSRF - 교차 사이트 요청 위조 ✅8 취약한 무차별 대입 공격 방어 ✅9 사용자 열거 ✅10 Referrer에서 리셋 비밀번호 토큰 유출 ✅11 비밀번호...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

CVE-2019-17625

CVE-2019-17625 rambox 0.6.9에는 사용자가 서비스를 추가할 때 name 필드의 매개변수가 제대로 샌티타이즈되지 않아 발생하는 저장형 XSS 취약점이 있습니다. rambox는 NodeJS에서 실행되므로 OS 명령을 또는 태그에 주입할 수 있습니다. 참고: 이 코드는 MacOS에서만 테스트되었으며 다른 운영 체제에서는 재구성이 필요할 수 있습니다. 익스플로잇 코드 익스플로잇 코드는 discord를 기본으로 사용하여 서비스를 생성합니다. 셸을 실행하려면 시스템에 mkfifo가 있어야 합니다. 물론 페이로드는 원하...

redjoust

ᵔᴥᵔ RedJoust A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron. Join the community Join the community of Kawaiipantsu / THUGSred and participate in the dev talk around Redjoust or simpl...

prithvi

Prithvi 보안 평가를 위한 보고서 생성 도구 사용법 이 프로젝트는 보고서 생성에 사용될 수 있으며 사용이 매우 쉽습니다. 다음 기능을 포함합니다 1. OWASP 유형 및 권장 사항을 세부 정보와 함께 추가할 수 있습니다. 2. 여러 프로젝트를 추가하고 별도로 작업할 수 있습니다. 3. 증명 개념과 함께 여러 취약점을 다른 프로젝트에 추가할 수 있습니다. 4. 보고서를 생성하면 문서 파일.docx을 제공합니다. 5. 현재 차트와 같은 더 많은 기능을 추가하려고 노력 중이며 곧 업데이트될 예정입니다. 설정 1. 서버에...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

Node.js st module Directory Traversal

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...

dvna

취약한 NodeJS 애플리케이션 DVNA 취약한 NodeJS 애플리케이션 DVNA은 OWASP Top 10 취약점을 시연하고 이러한 취약점을 수정하고 방지하는 방법을 안내하는 간단한 NodeJS 애플리케이션입니다. 수정 브랜치에는 취약점 수정 사항이 포함되어 있습니다. OWASP Top 10 2017 취약점에 대한 수정 사항은 fixes-2017 브랜치에 있습니다. 이 애플리케이션은 express, passport, sequelize 등 일반적으로 사용되는 라이브러리로 구동됩니다. 개발자 보안 가이드북 이 애플리케이션에는 취약...

Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Due to use of NodeJS libraries, IBM Cloud Pak System Software is affected by multiple vulnerabilities. These have been addressed in IBM Cloud Pak System Software version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Oracle Linux 10 : nodejs24 (ELSA-2026-73428)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73428 advisory. 24.21.0-1.0.1 - Add c-ares as dependency orabug 39781256 - Update upstream references 1:24.21.0-1 - Update to version 24.21.0 Tenable has extracted t...

Rocky Linux 10.2 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-devel / nodejs-docs / etc Multiple Vulnerabilities (crlsa-2026_75864)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202675864 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

AlmaLinux 8 : nodejs:22 (ALSA-2026:75870)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75870 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1972:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1972:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_75870)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202675870 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-94646

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

RHEL 8 : nodejs:22 (RHSA-2026:75870)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75870 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

RHEL 10 : nodejs22 (RHSA-2026:75864)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75864 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...