CVE-2024-28741-northstar-agent-rce-poc

NorthStar C2 agent RCE via stored XSS Agent RCE PoC for CVE-2024-28741, a stored XSS vulnerability in NorthStar C2. This exploit works by sending multiple malicious agent registration requests to the teamserver to incrementally build a functioning javascript payload in the logs web page. This XSS...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

EUVD-2026-92443

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-88391: Improper Control of Generation of Code

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

PT-2026-105996

Name of the Vulnerable Software and Affected Versions Northstar versions prior to 9.1.2 Description The software enables the H2 Console, but the authentication interceptor only covers the /northstar/ endpoint, leaving the /h2-console endpoint exposed without authentication. Additionally, the...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-88391

Northstar (dromara/northstar, quantitative trading platform) versions

Malicious code in elf-stats-peppermint-northstar-168 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7272 Malicious code in elf-stats-peppermint-northstar-168 (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2022-26959

There are two full read/write Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp pag...

Malicious code in elf-stats-cheery-northstar-345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11afb900180826fdc5929d1c3095198004109bd2107d02b1b6cd36c676b8aafd The package elf-stats-cheery-northstar-345 was found to contain malicious code...

EUVD-2025-202824

Malicious code in elf-stats-cheery-northstar-345 npm...

MAL-2025-192485 Malicious code in elf-stats-cheery-northstar-345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11afb900180826fdc5929d1c3095198004109bd2107d02b1b6cd36c676b8aafd The package elf-stats-cheery-northstar-345 was found to contain malicious code...

Malicious code in elf-stats-snowy-northstar-860 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060b69056cb70a9b63f02519787bc1ab10049d2dd86aef53a7e777a2176ec8ac The package elf-stats-snowy-northstar-860 was found to contain malicious code...

MAL-2025-192276 Malicious code in elf-stats-snowy-northstar-860 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060b69056cb70a9b63f02519787bc1ab10049d2dd86aef53a7e777a2176ec8ac The package elf-stats-snowy-northstar-860 was found to contain malicious code...

EUVD-2025-201115

Malicious code in elf-stats-snowy-northstar-860 npm...

EUVD-2025-200943

Malicious code in elf-stats-cocoa-northstar-632 npm...

EUVD-2025-200790

Malicious code in elf-stats-starlit-northstar-873 npm...

Malicious code in elf-stats-starlit-northstar-873 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c2cc5d2543003fa84ebbe677a2f636913b0cf1235b2975c9147eeb1839045d The package elf-stats-starlit-northstar-873 was found to contain malicious code...