Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting Detection

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Open-School 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WAGO - Remote Command Execution Detection

In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise. !/usr/bin/env python3 -- coding: utf-8 -- """In multiple product...

Palo Alto GlobalProtect CVE-2024-3400 Detection

Detects CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by confirming the SESSID path-traversal file-create canary 404 then 403. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect CVE-2024-3400 path traversal / RCE detection.""" import secrets from kittysploit import fr...

IoT vDME Simulator Panel - Detect

loT vDME Simulator panel was detected. Exposure IoT vDME Simulator panel allows anonymous access to create new Items. !/usr/bin/env python3 -- coding: utf-8 -- """loT vDME Simulator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

React CRA Asset Manifest Exposure Detection

Detects Create React App asset-manifest.json and similar build manifests that enumerate hashed bundles and help map the SPA attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CRA asset-manifest.json / build metadata exposure.""" import json from kittysploit import from...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...

Malicious Package

Overview @vaultflow/create-flow is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

MAL-2026-11096 Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...

@tarojs/cli-convertor (4.2.1-beta.0), @tarojs/create-app (4.2.1-beta.0) potentially affected by unknown CVE via @tarojs/cli (4.2.1-beta.0)

@tarojs/cli NPM version 4.2.1-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tarojs/cli and may be impacted: - @tarojs/cli-convertor 4.2.1-beta.0 - @tarojs/create-app 4.2.1-beta.0 Source cves: unknown CVE Source advisory:...

Malicious Package

Overview hubert-appointment-v2-task-create-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview checkout-create-pos-order-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

@tarojs/cli-convertor (4.1.12-beta.47), @tarojs/create-app (4.1.12-beta.47) potentially affected by unknown CVE via @tarojs/cli (4.1.12-beta.47)

@tarojs/cli NPM version 4.1.12-beta.47 is affected by a known vulnerability. The following packages have a transitive dependency on @tarojs/cli and may be impacted: - @tarojs/cli-convertor 4.1.12-beta.47 - @tarojs/create-app 4.1.12-beta.47 Source cves: unknown CVE Source advisory:...

Malicious Package

Overview @thebros/create-benjamin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview create-wrangler-deploy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview bigops-create-manifest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

EUVD-2026-49395

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and sto...

CVE-2026-66030

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow()

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow. A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow()

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow. A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure...