138 matches found
POC-CVE-2018-25031
CVE-2018-25031 - Swagger UI prima della 4.1.3 Un semplice POC CVE-2018-25031 che induce la vittima a inserire il codice di autorizzazione, che viene poi inviato all'attaccante. Puoi usarlo con la vulnerabilità XSS https://github.com/VictorNS69/swagger-ui-xss È necessario trovare il parametro e...
SwaggerSpy
SwaggerSpy Visão Geral O SwaggerSpy é uma ferramenta projetada para Inteligência de Fontes Abertas OSINT automatizada no SwaggerHub. Este projeto visa otimizar o processo de coleta de inteligência de APIs documentadas no SwaggerHub, fornecendo insights valiosos para pesquisadores de segurança,...
columbus-server
Columbus server This repository is deprecated! ‼️ The server component is moved to https://github.com/elmasy-com/columbus. Columbus Project is an API first subdomain discovery service, blazingly fast subdomain enumeration service with advanced features. Columbus returned 638 subdomains of tesla.co...
CVE-2026-21759
HCL Hive is affected by an information exposure vulnerability in which Swagger API documentation was publicly accessible to unauthenticated users. No sensitive data (credentials, PII) was discovered, but the exposure increases the overall attack surface by revealing API structure to potential att...
EUVD-2026-64837
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information e.g., credentials, PII was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface...
CVE-2026-21759 HCL Hive is affected by an information exposure vulnerability
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information e.g., credentials, PII was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface...
xed
Intel® X86 Encoder Decoder Intel® XED Manuale API Doxygen e manuale di compilazione dai sorgenti: https://intelxed.github.io Bug: https://github.com/intelxed/xed/issues/new Istruzioni di compilazione abbreviate da GITHUB : root@kitploit: git clone https://github.com/intelxed/xed.git xed git clone...
CVE-2026-14162
Advantech Hospital Queuing Management is listed under CVE-2026-14162 with a Missing Authentication/Unauthenticated access scenario. The description states a Sensitive Data Exposure where unauthenticated remote attackers can access a URL to obtain API documentation. The connected CVE entry confirm...
CVE-2026-14162
Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation...
CVE-2026-14162 Advantech｜Hospital Quering Management - Missing Authentication
Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation...
CVE-2026-14161 Advantech｜Hospital Queuing Management - Sensitive Data Exposure
Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation...
CVE-2026-8694 Improper access control on the API documentation endpoint in PowerShell Universal
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints...
Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...
CVE-2026-40991
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...
[SECURITY] Fedora 44 Update: kf6-kapidox-6.25.0-1.fc44
Scripts and data for building API documentation dox in a standard format and style...
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
Summary A Server-Side Request Forgery SSRF vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass th...
MAL-2026-2035 Malicious code in @emilgroup/api-documentation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c245a310d05383d1fdf2e98691e5ea42d0505bdab8e27120537609d6bb4acd The package @emilgroup/api-documentation was found to contain malicious code. Source: ghsa-malware...
CVE-2026-32844
XinLiangCoder phpapidoc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in listmethod.php that allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious code through the f parameter. Attackers can craft a malicious URL with...
EUVD-2026-12749
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. proto. This issue is patched in 1.4.27. As a workaround, use t.Cookie validatio...
