of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

dorkX

dorkX Conecta diferentes herramientas con el escáner de Google Dorks Versión 1.0 Instalación zoid@MSI /dorkX git clone https://github.com/ethicalhackingplayground/dorkX zoid@MSI /dorkX cd dorkX zoid@MSI /dorkX go build dorkx.go zoid@MSI /dorkX go build corsx.go zoid@MSI /dorkX go build csrfx.go...

CorsMe

...

CORStest

CORStest 一个简单的 CORS 配置错误扫描器 基于James Kettle 的研究 CORStest 是一个用于发现跨源资源共享（CORS）配置错误的 快速 工具，使用 Python 3 编写。它接受一个文本文件作为输入，该文件可以包含域名或 URL 列表。目前，通过发送特定的 Origin 请求头并检查 Access-Control-Allow-Origin 响应头，可以检测到以下潜在漏洞： 开发后门： 不安全的开发源（如 JSFiddle 或 CodePen）被允许访问此资源 Origin 反射： 来源被简单回显在 ACAO 头中，任何站点都被允许访问此资源 Null...

Corsy

Corsy CORS 配置错误扫描器 简介 Corsy 是一个轻量级程序，用于扫描 CORS 实现中的所有已知配置错误。 要求 Corsy 仅适用于 Python 3，并且只有一个依赖项：...

CVE-2026-55891

PrivateBin , a zero-knowledge PHP pastebin, is vulnerable to reflected JSON injection in its JSON-LD response paths (/?jsonld= and /?pasteid) in versions prior to 2.0.5 . The root cause is that FILTER_SANITIZE_URL does not strip quotation marks from $_SERVER['REQUEST_URI'], and the unsanitized va...

ApiHunter

Supporta lo sviluppo Se questo progetto ti è utile nel tuo lavoro, sostieni la manutenzione continua e le nuove funzionalità. Portafoglio di donazione ETH 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scansiona il codice QR o copia l'indirizzo del portafoglio qui sopra. 🎯 ApiHunter 📺 Demo Video Clic...

halo-cve-2026-67919

halo plugin rce von einer URL Die Halo-Konsole erlaubt es Administratoren, Plugins zu installieren und zu aktualisieren, indem sie eine URL einfügen. Sie holt die angegebene URL, installiert das Jar, und der Code des Jars läuft auf dem Server. Keine Scheme-Prüfungen, keine Host-Prüfungen, Redirec...

langflow-cors-scanner

CVE-2025-34291 — Langflow Origin Validation / CORS Panoramica Una configurazione CORS eccessivamente permissiva abbinata alla configurazione del cookie di refresh token consente il furto di credenziali...

Astra

Astra O teste de penetração em APIs REST é complexo devido a mudanças contínuas em APIs existentes e APIs recém-adicionadas. A Astra pode ser utilizada por engenheiros de segurança ou desenvolvedores como parte integrante do seu processo, permitindo detectar e corrigir vulnerabilidades no início ...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

EUVD-2026-67818

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

Chromium: CVE-2026-79034 Information leak in CORS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

theftfuzzer

root@kitploit: ┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introdução: TheftFuzzer é uma ferramenta que fuzza implementações de Cross-Origin Resource Sharing para configurações incorretas comuns. Uso: python theftfuzzer.py -d...

CVE-2020-10132

CVE-2020-10132 - CVE-2020-10132 - Il prodotto SearchBlox precedente alla V-9.1 è vulnerabile alla configurazione errata CORS. Descrizione del prodotto: SearchBlox semplifica la ricerca aziendale per organizzazioni complesse. Gli strumenti intuitivi e intelligenti di SearchBlox offrono una...

CVE-2019-17633

CVE-2019-17633 CSRF in Eclipse Che führt zu RCE Dieser Fehler erlaubt es einer entfernten Website, einen beliebigen Docker-Container auf Maschinen zu erstellen und zu starten, auf denen Che vor den Versionen 7.3.0 und 7.4.1 läuft, wenn ein Benutzer eine Webseite besucht. Schwachstelle Dies ist ei...