780504 matches found
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Summary orval, when generating MSW mocks output.mock: true, emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key expr ...
protectimus-slim-proxmark3
Script Lua Proxmark3 pour Protectimus SLIM NFC Ce script Lua pour la plateforme RFID Proxmark3 permet d'interagir avec le jeton matériel à mot de passe unique à base de temps TOTP Protectimus SLIM NFC. Configuration matérielle requise Proxmark3 Configuration logicielle requise RRG / Iceman -...
ldap-swak
LDAP Swiss Army Knife Многофункциональная утилита для LDAP-сервера. Быстрая настройка LDAP-сервера для тестовых целей, MitM-прокси для перехвата открытого текста или пересылки учетных данных NTLM, а также эксплуатация различных уязвимостей Java JNDI/LDAP-клиентов. Автор: Moritz Bechler...
GHSA-3575-W9FC-C2J6 Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
GHSA-653Q-5476-X79G Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
EUVD-2026-70655
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456
Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
Exploit for CVE-2026-65643
CVE‑2026‑65643 – cPanel Domain Parking RC...
CVE-2026-82526 R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...
CVE-2026-82526 R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...
CVE-2026-82526
R2R (SciPhi-AI) through 3.6.6 contains a stacked SQL injection in the vector index creation endpoint. The index name parameter is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, allowing unauthenticated attackers to exe...
EUVD-2026-70653
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...
MAL-2026-15919 Malicious code in megan-baileys (npm)
megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response ...
Malicious code in megan-baileys (npm)
megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response ...
Malicious code in @crysnovax/baileys (npm)
@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection connection.update with connection === 'open', wired in lib/Socket/socket.js it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher,...