svn-extractor

Svn-Extractor Многие тестировщики веб-приложений сталкиваются с наличием папок .svn. Для тех, кто не знает, папка .svn используется системой контроля версий SVN для выполнения своих операций. При черном ящике blackbox pentest эта папка содержит огромное количество информации. Вот некоторые ключев...

CVE-2025-55183

CVE-2025-55183 Scanner pour la vulnérabilité d'exposition du code source des Server Functions React. Qu'est-ce que c'est ? CVE-2025-55183 : Les Server Actions de React 19.0.0-19.2.1 peuvent être exploitées pour exposer l'intégralité de leur code source, y compris les secrets codés en dur, les clé...

CVE-2026-32662

CVE-2026-32662: Code de Débogage Actif en Production Avis Champ| Valeur ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Mise à jour A CVSS 3.1| 5.3 Moyen Vecteur| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Code de Débogage Actif Chercheur| Michael Groberman — Gr0m Publié| 2026-04-...

nextjs-security-update

nextjs-security-update Il y a des personnes qui construisent des outils OSS pour exploiter les nouvelles vulnérabilités de Next.js. Cet outil permet de riposter - il rend incroyablement simple la mise à jour de toutes vos applications Next.js sur l'ensemble de vos comptes GitHub. Utilise l'outil ...

react-server-cve-lab

Laboratoire de Sécurité des Composants Serveur React CVE-2025-55183 & CVE-2025-55184 Un environnement de test de sécurité complet pour les vulnérabilités CVE-2025-55183 Exposition de code source et CVE-2025-55184 Déni de service dans les Composants Serveur React. ⚠️ Avertissement À USAGE UNIQUEMEN...

CVE-2024-38475

CVE-2024-38475 эксплойт CVE-2024-38475уязвимость modrewrite с сопоставлением путей файловой системы Этот репозиторий содержит Python-скрипт для тестирования уязвимостей веб-серверов, в частности Apache. Скрипт проверяет потенциальные проблемы уязвимость modrewrite с сопоставлением путей файловой...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

CVE-2026-61782

The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9...

CVE-2026-84149

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

EUVD-2026-69059

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

PT-2026-84201

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...