3295 matches found
graphql-playground
It is an offensive tool for GraphQL. This repository contains a proof-of-concept PoC exploit for a vulnerability in the GraphQL Playground, a popular IDE for GraphQL development. The exploit targets an XSS Reflection attack vulnerability in the graphql-playground-html package, which was resolved ...
Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on the application...
Denial of Service (DoS)
Overview com.liferay:com.liferay.portal.vulcan.impl is a Liferay Portal Vulcan Implementation Affected versions of this package are vulnerable to Denial of Service DoS in the GraphQL process. An attacker can exhaust system resources by executing queries that return a large number of objects...
GHSA-F3HF-R62C-MFRJ Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on the application...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the GraphQL process. An attacker can exhaust system resources by executing queries that return a large number of objects. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...
CVE-2025-43796
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on the application...
CVE-2025-43796
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on the application...
CVE-2025-43796
CVE-2025-43796 affects Liferay Portal 7.4.0–7.4.3.101 and Liferay DXP 2023.Q3.0–2023.Q3.4, including 7.4 GA up to update 92 and 7.3 GA up to update 35. The issue is that GraphQL endpoints do not limit the number of returned objects, enabling remote DoS by queries that exhaust resources. The conne...
CVE-2025-43796
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on the application...
PT-2025-37343
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.101 Liferay DXP versions 2023.Q3.0 through 2023.Q3.4 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 35 Description: The software does not limit the...
Liferay Portal和Liferay DXP 资源管理错误漏洞
Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...
ebram_web_scanner
EBRAM Web Scanner EBRAM Web Scanner is a powerful Python-ba...
graphql-playground
This repository is an offensive tool for GraphQL. It is a GraphQL IDE for better development workflows, featuring context-aware autocompletion and error highlighting, interactive, multi-column docs, and support for real-time GraphQL Subscriptions. The tool is vulnerable to an XSS Reflection attac...
Malicious code in polaris-node-config-graphql-xml (npm)
The package polaris-node-config-graphql-xml was found to contain malicious code...
Malicious code in registry-library-registry-graphql (npm)
The package registry-library-registry-graphql was found to contain malicious code...
MAL-2025-45575 Malicious code in polaris-node-config-graphql-xml (npm)
The package polaris-node-config-graphql-xml was found to contain malicious code...
Malicious code in local-release-it-exec-graphql (npm)
The package local-release-it-exec-graphql was found to contain malicious code...
Malicious code in scripts-mysql-package-graphql (npm)
The package scripts-mysql-package-graphql was found to contain malicious code...