electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

CVE-2020-28502

CVE-2020-28502 node-XMLHttpRequest RCE NVD-Beschreibung Dies betrifft das Paket xmlhttprequest vor 1.7.0 sowie alle Versionen des Pakets xmlhttprequest-ssl. Sofern Anfragen synchron gesendet werden async=False bei xhr.open, kann schädliche Benutzereingabe, die in xhr.send fließt, dazu führen, das...

kubeeye

English | 中文 KubeEye is a cloud-native cluster inspection tool specifically designed for Kubernetes, capable of identifying issues and risks within the Kubernetes cluster based on custom rules. QuickStart Installation Download the installation package from Releases, which includes Helm chart, dem...

CVE-2026-82473

KubeEdge CloudCore through 1.23.1 has a missing authentication flaw on its HTTPS node task status report endpoint (port 10002 ). An unauthenticated attacker can reach this endpoint to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking furt...

CVE-2025-59528-PoC

CVE-2025-59528 PoC Script Python proof-of-concept per attivare il percorso RCE CustomMCP di Flowise tramite POST /api/v1/node-load-method/customMCP. ⚠️ Solo a scopo educativo e per ricerca sulla sicurezza autorizzata. Eseguire questo strumento contro sistemi che non possiedi o per i quali non hai...

CVE-2024-25897

parâmetros ip , puerto , ruta saída do exploit Painel de ajuda explicação do exploit Aqui está a explicação do código em Markdown: Explicação do Código Este script foi projetado para explorar uma vulnerabilidade específica no Jenkins CVE-2024-23897. Ele permite baixar um arquivo JAR de um servido...

node-pdf-generator-ssrf

CVE-2020-7740 Questo interessa tutte le versioni del pacchetto node-pdf-generator. A causa della mancanza di convalida e sanificazione dell'input dell'utente eseguita sul contenuto fornito a node-pdf-generator, è possibile per un attaccante creare un url che verrà passato a un server esterno...

EUVD-2026-68097

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

n8n versions = 0.123.0 and = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leadin...

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

node-srv - Local File Inclusion

node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. id: CVE-2018-3714 info: name: node-srv - Local File Inclusion author: madrobot severity: medium description: node-srv is vulnerable to local fil...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

Node RED Dashboard <2.26.2 - Local File Inclusion

NodeRED-Dashboard before 2.26.2 is vulnerable to local file inclusion because it allows uibase/js/..%2f directory traversal to read files. id: CVE-2021-3223 info: name: Node RED Dashboard 2.26.2 - Local File Inclusion author: gy741,pikpikcu severity: high description: NodeRED-Dashboard before...

Omnia MPX 1.5.0+r1 - Local File Inclusion

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel. id: CVE-2022-36642 info: name: Omnia MPX 1.5.0+r1 - Local Fi...

ban-exploitable-bitcoin-nodes

ban-exploitable-bitcoin-nodes Blocca tutti i nodi sfruttabili tramite la vulnerabilità di denial-of-service dal tuo nodo CVE-2018-17144 Requisiti per lo script bash ban.sh Processore JSON da riga di comando jq. Installazione su Linux basato su Debian root@kitploit: sudo apt-get install jq Scarica...

node-cve-2018-4407

node-cve-2018-4407 Codice PoC di exploit Node.js per CVE-2018-4407 Autore: Sam Decrock Questo script è basato sullo script scapy fornito da Zuk: iOS 12 / OS X Remote Kernel Heap Overflow CVE-2018-4407 POC in un tweet: pip install scapy sudo scapy sendIPdst=“Target...

Flowise-CVE-2025-58434-Chain-59528

Catena CVE di FlowiseAI - ATO CVE-2025-58434 e RCE CVE-2025-59528 ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento su sistemi di cui non si è proprietari o senza permesso scritto è illegale. Indice dei contenuti Questo repository contiene un proof-of-concep...

Rabbit Hole

Panoramica Rabbit Hole fornisce un sottoinsieme molto limitato delle funzionalità di Maltego, focalizzato sulla creazione di rappresentazioni visive di informazioni per il Penetration Testing. Consente la creazione di vari tipi di nodi come indirizzi IP, porte, servizi, ecc. e collegamenti tra di...