hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

cli

CloudGraph 是一个免费的开源通用 GraphQL API 和云安全态势管理（CSPM）工具，支持 AWS、Azure、GCP 和 K8s 。通过 CloudGraph，您可以获得： 免费且轻松的 合规性检查 （例如 Azure CIS 1.3.1、GCP CIS 1.2、AWS CIS 1.2、AWS CIS 1.3、AWS CIS 1.4、AWS PCI 3.2.1、AWS NIST 800-53 Rev. 4） 所有云环境中所有资源的 类型安全资产清单 自动生成的文档和查询验证——在发送查询之前就能知道其是否有效！ 包含资源间 关系 的完整资源数据，以便理解上下文...

CVE-2024-37843-POC

CVE-2024-37843-POC CVE-2024-37843 的 POC。Craft CMS 基于时间盲注 SQL 注入 详情见博客 POC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON assets.id =...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Plantilla de Nuclei Plantilla de detección no destructiva de Nuclei para CVE-2026-19478 , una vulnerabilidad crítica CVSS 9.4 de invocación arbitraria de métodos sin autenticación en la API GraphQL de GitLab, corregida por GitLab el 17 de agosto de 2026...

GraphQLer

唯一一款依赖感知的 GraphQL API 测试工具！ GraphQLer 是一款前沿工具，专为动态测试 GraphQL API 而设计，注重适应性。它提供一系列高级功能，可简化测试流程并确保对 GraphQL API 进行可靠分析。GraphQLer 能高效管理已创建的对象和资源，有效识别对象、查询和变更之间的依赖关系，并根据 API 的限制动态纠正查询中的错误。GraphQLer 已被用于在生产级 GraphQL API 中发现大量漏洞！ 主要功能 依赖感知 ：根据依赖关系执行查询和变更！ 动态测试 ：跟踪测试过程中创建的资源 错误纠正 ：尝试修复请求，以便 GraphQL API...

CVE-2026-4523

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523

GitLab CE/EE is affected by a missing authorization vulnerability in the GraphQL API (specifically the CI job trace API). Under certain conditions, this flaw could allow an unauthenticated user to read CI/CD job trace contents , potentially exposing sensitive variable values . The issue impacts v...

EUVD-2026-88690

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

FreeBSD: VID-3f11e437-b7cd-11f1-a883-2cf05da270f3 (CVE-2026-4523): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

CVE-2026-4523: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

GitLab 15.11 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-4523)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600

FreePBX, an open-source IP PBX, is vulnerable to Host Command Injection in versions prior to 17.0.9 . The vulnerability exists in the GraphQL api module's documentation generator , which accepts an authenticated host parameter and incorporates it into a shell command without proper validation or ...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - Enumeración de usuarios de GitLab GitLab es una herramienta de ciclo de vida DevOps basada en web y ampliamente utilizada que ofrece un administrador de repositorios Git con funciones integradas para integración continua, seguimiento de problemas, revisiones de código y más. La AP...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...