Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

Node.js st module Directory Traversal

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...

NodeSecurityShield

Node Security Shield Node Security Shield NSS は、オープンソースの Runtime Application Self-Protection RASP ツールであり、アプリケーションがアクセスできるリソースを 開発者 および セキュリティエンジニア が宣言できるようにすることで、包括的な NodeJS セキュリティのギャップを埋めることを目的としています。 アプリケーションが任意のネットワーク呼び出しを行えるために悪用される可能性がある Log4Shell CVE-2021-44228...

Recheck

Recheck Recheck ドメインを深くスキャンし、乗っ取り可能なすべてのドメイン を検出します クイックリンク デモ インストール 機能 例 実行 / インストール 実行方法は？ git clone https://github.com/tegal1337/Recheck cd Recheck npm install npm start 機能 機能| ステータス ---|--- ディープスキャン ドメイン| Ok 乗っ取り可能なドメインを発見| Ok 必要条件 Windows / Linux NodeJS v10 以上 寄付 ???...

dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...

dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA 是一个简单的 NodeJS 应用程序，用于演示 OWASP Top 10 漏洞 并提供修复和避免这些漏洞的指南。fixes 分支包含漏洞的修复代码。OWASssP Top 10 2017 漏洞的修复在 fixes-2017 分支。 该应用程序由常用的库驱动，例如 express、passport、sequelize 等。 开发者安全指南书 该应用程序附带一本 开发者友好的全面指南书 ，可用于学习、避免和修复漏洞。该指南位于 doc...

burp-exporter

Exporter Extension for Burp Suite Community and Pro Follow us to know more about tips and others extensions Description Exporter is a Burp Suite extension to copy a request to a file or the clipboard as multiple programming languages functions. It also adds a tab called Exporter where you can...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

reconness

ReconNess Webアプリケーション ReconNessを選ぶ理由 さて、多くの bugbounty ハッカーが recon を整理するためにテキストファイルを使い、出力をフィルタリングして潜在的に脆弱なターゲットに集中できるように、多数のbashスクリプトを書いているのを見てきました。しかし、現実的には、これには高度なbashスキルと、混沌とした感覚を避けるための強固なフォルダ/ファイル構成プロセスが必要です。 ReconNessは、すべての recon...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : nodejs:22 (RHSA-2026:75870)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75870 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2017-5941-NodeJS-RCE

CVE-2017-5941-NodeJS-RCE https://paper.seebug.org/213/...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

CVE-2014-7205

Bassmaster NodeJS 插件 RCE PoC bassmaster-rce.py：一个用于利用 CVE-2014-7205 的 Python 脚本。 nodeshell.py：一个用于生成 NodeJS 反向 shell 的 Python 模块。 ！！仅可用于您拥有测试权限的服务器 概述 CVE-2014-7205 是 Bassmaster NodeJS 插件中的一个远程代码执行漏洞。所有版本 = 1.5.1 均受影响。该漏洞存在于 lib/batch.js 文件中的 internals.batch 函数中，其中对 eval...

Linux Distros Unpatched Vulnerability : CVE-2026-86535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in...

Linux Distros Unpatched Vulnerability : CVE-2026-94645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This...

Linux Distros Unpatched Vulnerability : CVE-2026-83745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both...

Linux Distros Unpatched Vulnerability : CVE-2026-94646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution'...

Linux Distros Unpatched Vulnerability : CVE-2026-96294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0...

CVE-2026-83745

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...