DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

¡Bienvenido a React Router! Una plantilla moderna y lista para producción para construir aplicaciones React full-stack con React Router. Características 🚀 Renderizado del lado del servidor ⚡️ Reemplazo de Módulos en Caliente HMR 📦 Empaquetado y optimización de assets 🔄 Carga de datos y mutaciones ...

domdig

DOMDig DOMDig es un escáner de DOM XSS que se ejecuta dentro del navegador web Chromium y puede escanear aplicaciones de página única SPA de forma recursiva. A diferencia de otros escáneres, DOMDig puede rastrear cualquier aplicación web incluyendo gmail manteniendo un registro de las...

htcap

HTCAP htcap es un escáner de aplicaciones web capaz de rastrear aplicaciones de una sola página SPA de forma recursiva interceptando llamadas ajax y cambios en el DOM. CARACTERÍSTICAS PRINCIPALES Motor de rastreo DOM recursivo Descubre solicitudes ajax/fetch/jsonp/websocket Soporta cookies, proxy...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d7fc29f59609ed2b5c7b54243b740e1daa001f3c76c4d1391edd85a528a4688 The package's postinstall script runs automatically on npm install and collects installer-side host and credential data: hostname, username, network...

Malicious code in @galicia-toolkit/spa-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d7fc29f59609ed2b5c7b54243b740e1daa001f3c76c4d1391edd85a528a4688 The package's postinstall script runs automatically on npm install and collects installer-side host and credential data: hostname, username, network...

wix-kickstartx-challenge-writeup

Wix KickstartX Challenge 2026 — Full Writeup Result: 200/200 100% — Token: WKX-9245FA70-200 Date: March 24, 2026 1. Discovery & Reconnaissance The Challenge Announcement A LinkedIn post announced a special challenge for Wix KickstartX — a junior developer program. The rules: 30 minutes, one...

CVE-2023-43148

CVE-2023-43148 Autor : Aitor Herrero Fuentes Proveedor: SPA-Cart Página del proveedor: https://spa-cart.com/ Enlace del software: https://demo.spa-cart.com/admin Versión: 1.9.0.3 Probado en: Windows 10 Pro CSRF ELIMINAR TODAS LAS CUENTAS La vulnerabilidad de Cross Site Request Forgery en la...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2023-43149

CVE-2023-43149 Autor : Aitor Herrero Fuentes Proveedor: SPA-Cart Sitio web del proveedor: https://spa-cart.com/ Enlace del software: https://demo.spa-cart.com/admin Versión: 1.9.0.3 Probado en: Windows 10 Pro CSRF AÑADIR CUENTA ROOT La vulnerabilidad de Cross Site Request Forgery en la aplicación...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PT-2026-105798

Impact djust's per-object authorization get object + has object permission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA url change navigation, and c % live render % embedded child views. An...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778297730)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778297730 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malforme...

CentOS Linux 6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS6:CLSA-2026:1778024392)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778024392 advisory. - In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that...

PT-2026-94122

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description An issue exists in the per-object authorization mechanism involving the get object and has object permission functions. While authorization was enforced on WebSocket mount and event paths, it was missi...

Astra Linux – Vulnerability in exim4

In Exim versions before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be a vulnerability where an out-of-bounds write could cause the connection instance to crash, or erroneous data processing could lead to data being leaked from uninitialized heap...

SPA: Securing Persistent LLM Agents across Queries with Plan-First Information-Flow Control

Large language model LLM agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources. Existing defenses typically protect either planning or individual tool interactions, but persistent agents face a...

Malicious Package

Overview devplatform-spa-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview devplatform-spa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...