stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

CVE-2026-19478

CVE-2026-19478 GitLab GraphQL 인증 없는 프로젝트 삭제 ★ CVE-2026-19478 GitLab GraphQL @glintroduced 인증 없는 임의 메서드 호출 PoC ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b 개요 CVE-2026-19478 은 GitLab CE/EE 의 인증 없는 데이터 조작/삭제 취약점입니다 CVSS 9.4. GitLab은 롤링 배포 순방향 호환성을 위해 GraphQL 클라이...

CVE-2026-44840-poc

CVE-2026-44840 — PoC: checkUserPassword를 통한 Dgraph DQL 인젝션 GraphQL Dgraph에서 실제 인젝션을 재현하는 Docker 랩: 취약 : dgraph/dgraph:v25.3.3 패치됨 : dgraph/dgraph:v25.3.4 2026년 실제 CVE · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Query Logic · Kai Aizen에게 귀속됨 GHSA-q2m9-6jp9-c6mc, GO-2026-5837. 격리되...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-23745-via-graphql-DEMO

이 저장소에는 README가 없습니다...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

EUVD-2026-90922

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921

The GraphQL Tools library (prior to version 1.1.35 ) contains a vulnerability where the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection to be disabled for Node.js connections to wss:// endpoints. If an application uses this executor directly or uses url-loa...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Nuclei 템플릿 CVE-2026-19478 에 대한 비파괴적 Nuclei 탐지 템플릿입니다. 이 취약점은 GitLab GraphQL API의 인증되지 않은 임의 메서드 호출 결함으로, 심각도CVSS 9.4 등급이며 GitLab에서 2026년 8월 17일 에 패치했습니다. TL;DR GitLab의 GraphQL 스키마는 필드를 특정 최소 GitLab 버전으로 제한하는 @glintroducedversion: "X.Y.Z" 디렉티브를 지원합니다. 디렉티...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – ID 조작을 통한 GraphQL Persisted Queries 인젝션 프로그램 코드Node.js // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql', graphqlHTTP schema: schema,...

CVE-2026-XXXX-atlassian-email-enumeration

CVE-2026-XXXX: Atlassian Central GraphQL — 이메일 열거 오라클 제품 Atlassian Central GraphQL Gateway api.atlassian.com/graphql 취약점 유형 CWE-204: 관찰 가능한 응답 불일치 — 이메일 열거 오라클 심각도 MEDIUM — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 설명 Atlassian 중앙 GraphQL 게이트웨이의 loomUnauthenticatedprimaryAuthTypeForEmail Graph...

GitLab-Graphql-CVE-2020-26413

GitLab-Graphql-CVE-2020-26413 GitLab-Graphql-CVE-2020-26413 POC 단일 검증: python3 GitlabCVE-2020-26413.py -u http://127.0.0.1 일괄 검증 python3 GitlabCVE-2020-26413.py -f target.txt 스크립트 현재 경로에 취약점 결과가 생성됩니다...

CVE-2022-2466---Request-Context-not-terminated-with-GraphQL

CVE-2022-2466 Request-Context-not-terminated-with-GraphQL 실행 방법 1. mvn:quarkus:dev 실행 2. 다음 HTTP 요청 실행 이것을 두 번 실행하세요 POST http://localhost:8080/graphql Content-Type: application/graphql Authorization: Bearer...

CVE-2025-55817

취약점 유형 크로스 사이트 스크립팅 XSS 영향받는 구성 요소 Chillicream의 Nitro GraphQL 연결 설정에는 크로스 사이트 스크립팅XSS에 취약한 3개의 다른 입력 위치가 포함되어 있습니다. 취약한 파라미터: SDL Schema Endpoint, Subscription Endpoint, SSE Subscription Endpoint 공격 유형 원격 영향: 정보 노출 true 공격 벡터 3개의 입력 필드가 XSS 페이로드에 취약합니다 : 공급업체 확인 여부 true 발견자 Brian Lowe -...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

EUVD-2026-90208

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...