17 matches found
GraphQLGrapper
An extension to collect GraphQL functions from Burpsuite requests history How to use You need will need Jython standalone jar 1. Go to Extensions tab 2. Click on Add 3. Choose GraphQLGrapper.py 4. Now you can use it by right click on the target and choosing the extension Result...
EUVD-2026-71629
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...
CVE-2026-61688: Authorization Bypass Through User-Controlled Key
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...
9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats
Multiple critical API security vulnerabilities were discovered in 9Router's Next.js dashboard. The /api/providers endpoints lack authentication entirely, allowing anyone to create, read, update, and delete provider connections. Additionally, /api/usage/stats exposes full plaintext API keys, and...
EUVD-2022-30044
Malicious code in bioql PyPI...
CVE-2022-25373
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...
CVE-2024-52951
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History...
CVE-2024-52951
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History...
CVE-2024-52951
Omada Identity versions prior to 15 update 1 (including versions
CVE-2024-52951
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History...
CVE-2024-52951: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History...
CVE-2022-25373
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...
CVE-2022-25373
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...
CVE-2022-25373
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...
Cross site request forgery (csrf)
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...