cirrusgo

CirrusGo SAAS、PAASアプリケーションをGoで高速にスキャンするツール SAASアプリケーションサポート: salesforce contentful（次期バージョン） 注意：-oフラグの出力は機能していません インストール: golang 1.18Ver root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest ヘルプ: root@kitploit:...

Contentful <=2020-05-21 - Cross-Site Scripting

Contentful through 2020-05-21 for Python contains a reflected cross-site scripting vulnerability via the api parameter to the-example-app.py. id: CVE-2020-13258 info: name: Contentful alert...

CVE-2026-53957 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...

CVE-2026-53957

CVE-2026-53957 affects the Contentful MCP Server (@contentful/mcp-tools and @contentful/mcp-server). The export_space and import_space tools spread LLM-controlled host, proxy, rawProxy, and insecure arguments into the options passed to the Contentful Management API SDK, which then attaches the se...

CVE-2026-53957

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:15+00:00| published-proof-of-concept| https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx...

@contentful/mcp-server (>=1.7.0-dev-20251016T1739-07b05ef.0, <=1.7.18), @iflow-mcp/contentful-contentful-mcp-server (>=1.7.7, <=1.7.8) potentially affected by CVE-2026-53957 via @contentful/mcp-tools (>=0.1.0, <=0.4.4)

@contentful/mcp-tools NPM version =0.1.0, =1.7.0-dev-20251016T1739-07b05ef.0, =1.7.7, =1.7.8 Source cves: CVE-2026-53957 Source advisory: OSV:GHSA-2XHG-73J7-RRGX...

GHSA-2XHG-73J7-RRGX Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)

npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11842 Malicious code in @servicetitan/contentful-proxy (npm)

npm/@servicetitan/contentful-proxy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PYSEC-2026-626 Cross-site scripting in Contentful

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py...

EUVD-2021-1319

Malware in sbrugna...

Malicious code in contentful-app-entry-localization-matrix (npm)

The package contentful-app-entry-localization-matrix was found to contain malicious code...

MAL-2025-41957 Malicious code in contentful-app-entry-localization-matrix (npm)

The package contentful-app-entry-localization-matrix was found to contain malicious code...

Malicious code in contentful-build-bot (npm)

The package contentful-build-bot was found to contain malicious code...

MAL-2025-26204 Malicious code in mericsson-gatsby-source-contentful (npm)

The package mericsson-gatsby-source-contentful was found to contain malicious code...

Malicious code in mericsson-gatsby-source-contentful (npm)

The package mericsson-gatsby-source-contentful was found to contain malicious code...

MAL-2025-17515 Malicious code in contentful-build-bot (npm)

The package contentful-build-bot was found to contain malicious code...

CVE-2020-13258

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +109 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =0.2.8, =0.3.45 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...