387 matches found
XSS-Scanner
XSS Scanner Cross-Site Scripting XSS is one of the most well known web application vulnerabilities. It even has a dedicated chapter in the OWASP Top 10 project and it is a highly chased vulnerability in bug bounty programs. The scanner gets a link from the user and scan the website for XSS...
fingerprint-suite
fingerprint-suite is a handcrafted assembly of tools for browser fingerprint generation and injection. Today's websites are increasingly using fingerprinting to track users and identify them. With the help of fingerprint-suite you can generate and inject browser fingerprints into your browser,...
puppeteer-extra
puppeteer-extra This is the monorepo for puppeteer-extra, a modular plugin framework for puppeteer. :- 🌟 For the main documentation, please head over to thepuppeteer-extra package. We've also recently introduced support for Playwright, if you're interested in that head over to playwright-extra...
CVE-2024-36527
CVE-2024-36527 PoC and Bulk Scanner Overview POC for CVE-2024-36527: puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server. Based on the security advisory published ...
GHSA-9GVV-QJJ3-2P6G Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
EUVD-2026-57799
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium...
NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
Automated-Next.js-Security-Scanner-for-CVE-2025-29927
Next.js CVE-2025-29927 Vulnerability Scanner A command-line security scanner for identifying publicly accessible Next.js applications that may be exposed to CVE-2025-29927. Disclaimer This tool is intended for authorized security testing, vulnerability assessment, research, and defensive security...
CVE-2026-91938
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
EUVD-2026-78796
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
PT-2026-92058
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
CVE-2026-91938: Server-Side Request Forgery (SSRF)
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...
CVE-2026-91079
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...
CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...
EUVD-2026-77714
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...
CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...
CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...