POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI before 4.1.3 A simple POC CVE-2018-25031 that tricks the victim into entering the authorization code, which is then sent to the attacker. You can use it with the XSS Vulnerability https://github.com/VictorNS69/swagger-ui-xss It is necessary to find the parameter and...

CVE-2026-111622

The smart-sso application (versions through 2.1.1 ) is vulnerable to an open redirect in the /login handler. This flaw allows unauthenticated attackers to steal OAuth2 authorization codes by providing an unvalidated redirectUri parameter. An attacker can trick a user with an active SSO session in...

CVE-2026-111622 smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem...

CVE-2026-111622 smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem...

CVE-2026-111622 smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem...

CVE-2026-107503

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect OIDC provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopt...

EUVD-2026-94823

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...

PT-2026-107877

Name of the Vulnerable Software and Affected Versions Eclipse Ditto Ditto Explorer versions 3.6.0 through 3.9.7 Description An issue exists where unvalidated environment URLs allow the injection of an attacker-controlled OIDC authority when autoSso is enabled. This leads to the theft of OAuth...

CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

Malicious code in lib-bb-html-sanitizer (npm)

Source: checkmarx 74072bddc9908e0147976fde0680c197ac5b38167bfcdf14afc5f79f23749f72 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in kiwi_vicious (npm)

Source: checkmarx 24d3a7f0211bfcde4618961d390577b0a47d7aab36c363af84243b2427fc1c51 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in kaluza-careers (npm)

Source: checkmarx 7fc6bb8e84e2499d431b69a1efe08fbdc626b2801e898180833dde64c951c39e Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in hideorg-lvl (npm)

Source: checkmarx cadb232e4b479810d217f2adbfed5e8dba555837082c21bb6fc0501c0686c462 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ossf-package-analysis ead8b3662c808468abcb65cf3b14e15d072c5a55ab367208aa9d43279d39e353 The OpenSSF Package Analysi...

Malicious code in developer_backup_test531 (npm)

Source: checkmarx ba34269365aec86c0211ee348c1cc4f84e68214a7aed51304d8a309857881001 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in developer_backup_test527 (npm)

Source: checkmarx 873572cb006dd8216d097e1014bc26f4f54e2e57b00c4ed5db617993287c9735 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in developer_backup_test522 (npm)

Source: checkmarx 8b52e3ebbc9f77499af5305ed66af90a110e8aa4ae801a722309d25dfe72f01a Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in developer_backup_test525 (npm)

Source: checkmarx 801d93e817d2a88be92c4ce8b23fb15ec2a02dba59eea3666d03eee45d2dd072 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in cxp-jquery (npm)

Source: checkmarx b0e4725a2db5433915386ce19dadd7812b0f44e9afcb7c48d855797cf7a78537 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in cnp_al_corp_front (npm)

Source: checkmarx ca87bb9f11572bb7178a087d94273972886a104b0d9f9b25ea8799b418f8c85c Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in angular-1.8 (npm)

Source: checkmarx 3d45e146db01c8e2d986dd73f9991c083be30195ff986c99817c93e1be410b60 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...