cli

CloudGraph is the free open-source universal GraphQL API and Cloud Security Posture Management CSPM tool for AWS, Azure, GCP, and K8s. With CloudGraph you get: Free and effortless compliance checks i.e. Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, AWS CIS 1.3, AWS CIS 1.4, AWS PCI 3.2.1, AWS NIST...

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

GraphQLer

The only dependency-aware GraphQL API testing tool! GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on adaptability. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs. GraphQLer...

CVE-2024-37843-POC

CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-based blind SQLi Details available in blog POC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Plantilla de Nuclei Plantilla de detección no destructiva de Nuclei para CVE-2026-19478 , una vulnerabilidad crítica CVSS 9.4 de invocación arbitraria de métodos sin autenticación en la API GraphQL de GitLab, corregida por GitLab el 17 de agosto de 2026...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - GitLab 用户枚举 GitLab 是一款广泛使用的基于 Web 的 DevOps 生命周期工具，提供 Git 仓库管理器，并集成持续集成、问题跟踪、代码审查等功能。GraphQL API 是一个强大的接口，允许用户以编程方式与 GitLab 交互并执行各种操作。 GitLab CVE-2021-4191 漏洞源于特定版本 GitLab 的 GraphQL API 中用户枚举的疏忽。启用了注册限制的私有 GitLab 部署实例可能受到此问题的影响。...

CVE-2021-4191_Exploits

CVE-2021-4191漏洞利用 pip install python-graphql-client 用法： python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql 版权：https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-18885

CVE-2026-18885 is a code injection vulnerability in the ServiceNow AI platform , specifically in its GraphQL Composite Data API , enabling an unauthenticated attacker to execute arbitrary code and access or modify instance data. The CVSS 4.0 base score is 10.0 (Critical) with all impact dimension...

CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

EUVD-2026-63683

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...