11968 matches found
test-reflected-xss-nodejs
It is an offensive tool for web application security testing. Th...
Node.js: fs.futimes() Bypasses Read-Only Permission Model
A flaw in Node.js's permission model was discovered that allowed a file's access and modification timestamps to be changed via futimes even when the process had only read permissions. Unlike utimes, futimes did not apply the expected write-permission checks, which meant file metadata could be...
PT-2025-42540
Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.18 Angular versions prior to 20.3.6 Angular versions prior to 21.0.0-next.8 Description The issue is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering...
CVE-2025-62380: Improper Neutralization of Input During Web Page Generation
mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.31 contain an HTML injection vulnerability in plaintext emails generated with the generatePlaintext method when user generated content is supplied. The plaintext...
CVE-2025-62366: Improper Neutralization of Input During Web Page Generation
mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.30 contain an HTML injection vulnerability in plaintext emails produced by the generatePlaintext method when user‑generated content is supplied. The function attempts t...
Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers
Cybersecurity researchers have disclosed details of an active malware campaign called Stealit that has leveraged Node.js' Single Executable Application SEA feature as a way to distribute its payloads. According to Fortinet FortiGuard Labs, select iterations have also employed the open-source...
CVE-2025-61927: Improper Control of Generation of Code
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE Remote Code Execution attacks. A Node.js VM Context is not an isolated environment, and if the us...
FlowiseAI/Flosise has File Upload vulnerability
Summary A file upload vulnerability in FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution RCE. Details The system fails to...
EUVD-2021-2379
Malware in sbrugna...
EUVD-2019-0205
Malware in sbrugna...
EUVD-2019-0239
Malware in sbrugna...
EUVD-2021-0776
Malware in sbrugna...
EUVD-2017-0221
Malware in sbrugna...
EUVD-2019-0224
Malware in sbrugna...
EUVD-2017-0262
Malware in sbrugna...
EUVD-2017-0261
Malware in sbrugna...
EUVD-2017-0335
Malware in sbrugna...
EUVD-2020-0571
Malware in sbrugna...