vapi

vAPI...

CVE-2024-23738

CVE-2024-23738 Postman 10.22 及更早版本在 macOS 上存在一个安全问题，允许远程攻击者通过 RunAsNode 和 enableNodeClilnspectArguments 设置执行任意代码。 有一个用于自动搜索 Electron 漏洞的工具：https://github.com/r3ggi/electroniz3r 使用该工具，我们可以检查应用是否存在漏洞： 验证后，我们可以注入代码并获取 Shell： 享受你的 Shell :...

porch-pirate

Porch Pirate Porch Pirateは、Postmanのシークレットを迅速に発見するツールとして始まり、徐々にPostman向けの多目的偵察/OSINTフレームワークへと進化してきました。既存のツールは優れた概念実証ですが、非常に限定されたキーワードだけを「シークレット」として識別しようとし、場所も限られており、シークレット以外の偵察は考慮されていません。私たちは、シークレットに依存しない（secret-agnostic）機能と、攻撃的価値を持つ偽陽性（false-positive）を捉える十分な柔軟性が必要であることに気付きました。 Porch...

docker-cve-2021-41773

CVE-2021-41773 演示CVE-2021-41773漏洞在Docker容器上的利用。 使用 服务端 运行 build.sh（执行 docker 构建） root@kitploit: ./scripts/build.sh 注意：无需执行多次 运行 deploy.sh（使用 build.sh 构建的镜像创建 Docker 容器） root@kitploit: ./scripts/deploy.sh 关闭容器请运行以下命令： root@kitploit: docker rm --force cve-2021-41773 演示漏洞利用 使用 bash： root@kitploit:...

Burp_Collector

Burp Collector Burp Collector 是一个多进程工具，专为渗透测试人员和漏洞猎人在 Web/移动应用测试中设计。凭借其强大的功能，它简化了从 Burp Suite 文件中收集和提取信息的过程，使您能够高效管理 API 端点。 Burp Collector 高效地组织 API 端点，并将其无缝导出到 Excel 表格，确保项目结构清晰且易于访问。通过简化端点管理，它节省了宝贵的时间，让您专注于关键的测试任务。 开发者：Sagiv 功能特性 1. 收集并提取您在测试中交互过的所有 API 端点（SOAP、REST 和 GraphQL）到 Excel 文件 - 强烈推荐...

MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PYSEC-2026-2393 BBOT: Arbitrary File Write in postman_download Module

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

MAL-2026-6639 Malicious code in @postman-app-monolith/renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4ea9912817d4d94e8b97e2b588237f3f2cddc29058e81d8958ec78b4b90d961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-37818

BBOT: Arbitrary File Write in postmandownload Module...

GHSA-M54H-VHF9-3W3M BBOT: Arbitrary File Write in postman_download Module

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

BBOT: Arbitrary File Write in postman_download Module

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

CVE-2026-12568

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

CVE-2026-12568

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

CVE-2026-12568 Arbitrary File Write in postman_download module

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

CVE-2026-12568

The CVE-2026-12568 entry affects the postman_download module. The root cause is unsanitized use of the workspace name field from the Postman API to build the local output directory path; if the workspace name contains path traversal characters, pathlib resolves outside the intended directory, ena...

PT-2026-50563

Name of the Vulnerable Software and Affected Versions Postman Download Module affected versions not specified Description The postman download module fails to sanitize the workspace name field retrieved from the Postman API when constructing local directory paths. A malicious workspace name...

CVE-2026-28408

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionartipodocsatendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like...

CVE-2017-18603

The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...

CVE-2025-15095

CVE-2025-15095 affects postmanlabs httpbin up to 0.6.1. The flaw is in httpbin-master/httpbin/core.py, enabling cross-site scripting via manipulated input. Exploitation is remote and publicly disclosed. Multiple sources confirm the vulnerability, but remediation notes vary and, in at least one en...