CVE-2023-45827

CVE-2023-45827 취약점 개요 CVE-2023-45827 CVSS : 9.8 Nov 3, 2023 ProtoType Pollution in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories This is a Prototype PollutionPP vulnerability in dot-diver. It can leads to RCE. vulnerable code root@kitploit:...

Malicious code in id79-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

ReactNext2Shell

React-Next-Scanner CVE-2025-55182 및 CVE-2025-66478 용 안전한 CLI 스캐너 이 도구는 최신 JavaScript 스택에 초점을 맞춘 경량의 비악용 취약점 스캐너를 제공합니다. 구체적으로는 다음과 같습니다: CVE-2025-55182 의 영향을 받는 API 서비스 CVE-2025-66478 의 영향을 받는 Next.js 애플리케이션 지원 플랫폼: ✅ Windows ✅ Linux ✅ macOS ✨ 기능 크로스 플랫폼 Python CLI 스캐너 휴리스틱 기반의 안전한 탐지악용 없음 공개된...

lodash.template-fixed

lodash.template v4.5.0 Lodash のメソッド .template を Node.js モジュールとしてエクスポートしたものです。 インストール npm を使用する場合: root@kitploit: $ sudo -H npm i -g npm $ npm i --save lodash.template Node.js での使用: root@kitploit: var template = require'lodash.template'; 詳細については、ドキュメント または パッケージソース を参照してください。...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 상세 설명 0.0.0 버전부터의 pdfkit 패키지는 URL이 제대로 삭제sanitize되지 않아 명령 삽입Command Injection에 취약합니다. PoC HTTP 서버 시작 root@kitploit: 1- python3 -m http.server 80 netcat 리스너 시작 root@kitploit: 2- nc -lnvp 'Target Port' 요청 만들기 root@kitploit: 3- http://"TARGETADDRESS:Target...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm mcp-from-openapi versions = 2.3.0, 2.5.0...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE 익스플로잇 도구 expr-eval 및 expr-eval-fork npm 패키지의 CVE-2025-12735 취약점을 탐지하고 테스트하기 위한 보안 연구 도구입니다. ⚠️ 면책 조항 이 도구는 승인된 보안 테스트 및 교육 목적으로만 사용됩니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 본 도구는 소유하고 있거나 명시적인 서면 허가를 받은 시스템에서만 사용하십시오. 📋 개요 CVE-2025-12735는 expr-eval 및 expr-eval-fork npm 패키지에서 발견된...

revera

Revera npm 패키지용 신용 점수. Revera는 npm install을 실행하기 전에 패키지를 설치할 가치가 있는지 판단할 수 있게 도와줍니다. 패키지 품질, 유지보수, 보안, 생태계 건강도, 게시자 신뢰도를 분석하고 — 이제 전체 의존성 그래프에 걸쳐 위험을 전이적으로 전파하며 — 설명 가능한 베이지안 평판 리포트를 생성합니다. 데모...

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-73086 CVE-2026-73086 in nanoid - Patched by Root

Root has patched CVE-2026-73086 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-32640 CVE-2021-32640 in ws - Patched by Root

Root has patched CVE-2021-32640 in the ws package for Root:npm. Multiple fixed versions available...

GHSA-JXFW-X594-9X9M vulnerabilities

Vulnerabilities for packages: azurite, wazuh-dashboard, wazuh-dashboard-fips...

ROOT-APP-NPM-GHSA-5C6J-R48X-RMVQ GHSA-5c6j-r48x-rmvq in serialize-javascript - Patched by Root

Root has patched GHSA-5c6j-r48x-rmvq in the serialize-javascript package for Root:npm. Multiple fixed versions available...

Malicious code in strapi-plugin-vinsoc-1109 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbb0aa83cfffbdd408abb8f73299d5a47a0e9855c65b5940bb22112e0928d41 The package's postinstall lifecycle script node postinstall.js || true fires automatically on npm install. postinstall.js reads os.hostname, embeds t...

NPM: OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

NPM: OmniRoute ACP Custom-Agent Remote Code Execution RCE vulnerability discovered by ? in WordPress Npm omniroute versions = 3.8.50...

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

MAL-2026-16124 Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...