WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...

Stash < 0.26.0 - SQL Injection

Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. id: CVE-2024-32231 info: name: Stash Stash" tags: cve,cve2024,stash,sqli,vuln http: - raw: - | POST /graphql HTTP/1.1 Host: Hostname Content-type: application/json...

Craft CMS <=v3.7.31 - SQL Injection

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. id: CVE-2024-37843 info: name: Craft CMS =v3.7.31 - SQL Injection author: iamnoooob,rootxharsh,pdresearch severity: critical description: | Craft CMS up to v3.7.31 was discovered to conta...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

SkyWalking SQLI

When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQ...

Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure

GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2020-26413 info:...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

GraphQLmap

GraphQLmap GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. Install Features and examples Dump a GraphQL schema Interact with a GraphQL endpoint Execute GraphQL queries Autocomplete queries GraphQL field fuzzing Example 1 - Bruteforce a character Examp...

resterm

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is a code-first API client built around plain .http/.rest files. A request is a few lines of text you can read, diff and keep in git, and the same goes for workflows and local mocks. You send them from the terminal UI...

CVE-2021-4191_Exploits

CVE-2021-4191Exploits pip install python-graphql-client Usage: python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql Copyrights: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

aura-inspector

aura-inspector This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program. Introduction aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

inql

InQL v6.1.2 - Burp Extension for Advanced GraphQL Testing !Doyensec Research...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

hulak

Hulak Your messenger in the terminal. Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive hulak run ./requests/ Hulak runs request files directly from your project. It supports concurrent directory execution. It falls back to an...

Damn-Vulnerable-GraphQL-Application

Damn Vulnerable GraphQL Application Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. Table of Contents About DVGA Operation Modes Scenarios Prerequisites Installation Installation - Docker...

CVE-2026-24136-Lab

CVE-2026-24136 - Saleor GraphQL IDOR / Unauthenticated PII Exfiltration Overview Field| Details ---|--- CVE ID| CVE-2026-24136 Vulnerability Type| IDOR - Authorization Bypass Through User-Controlled Key CWE-639 Software| Saleor e-commerce platform Affected Versions| 3.2.0 - 3.20.109 · 3.21.0 -...

CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...