GitDump

GitDump GitDump dumps the source code from .git when the directory traversal is disabled Requirements Python3 Tested on Windows Kali Linux What it does Dump source code from website/.git directory when directory traversal is disabled. How it works Fetch all common files .git/index, .git/HEAD,...

CVE-2025-55183_POC

CVE-2025-55183 - Next.js RSC Server Function Source Code Disclosure A source code disclosure vulnerability in Next.js React Server Components RSC. A malicious HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function when the argument is...

CVE-2025-55182

CVE-2025-55182 Scanner This repository contains a scanner tool for CVE-2025-55182 RCE and CVE-2025-55183 Source Code Disclosure in Next.js React Server Components RSC. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Do not use this tool on systems you do not own or...

bfac

BFAC Advanced Backup-File Artifacts Testing for Web-Applications BFAC Backup File Artifacts Checker is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords,...

RSC-Scanner-POC

Next.js RSC 源代码泄露扫描器 用于检测 CVE-2025-55183（Next.js React 服务端组件 RSC 源代码泄露漏洞）的安全扫描器。 描述 该扫描器用于检测 Next.js React 服务端组件（RSC）中的源代码泄露问题。当向存在漏洞的服务端函数发送恶意 HTTP 请求时，若参数被序列化为字符串，该请求可能不安全地返回任意服务端函数的源代码。 特性 🔍 自动扫描 ：扫描单个 URL 或批量主机列表 ⚡ 并发扫描 ：多线程扫描，提升速度 🔄 重试逻辑 ：自动重试并采用指数退避，应对瞬时故障 📊 多种输出格式 ：支持文本、JSON 和 CSV 格式 🚦 速率限...

CVE-2025-55183-poc

CVE-2025-55183-poc – Next.js React Server Components 服务器函数源代码泄露 本仓库包含用于检测 Next.js React Server Components RSC / Server Actions 中源代码泄露漏洞（编号 CVE-2025-55183）的工具。 在受影响的应用中，向服务器函数发送精心构造的 HTTP 请求可能导致该函数在引用被字符串化时（例如通过模板字符串或数据库查询中的隐式转换）返回完整的 JavaScript 源代码 。 React 的修复为服务器引用添加了 toString...

chall.stypr.com

chall.stypr.com Gracias por jugar en chall.stypr.com Han pasado nueve años desde que configuré y alojé por primera vez mi wargame. Muchos CTF ya han reutilizado o creado desafíos similares, así que he decidido compartir el código fuente de todos los desafíos y las configuraciones utilizadas para...

cgiemail-exploit

Cgiemail - 源代码泄露/本地文件包含漏洞利用 cgiecho 是 cgiemail 附带的一个脚本，如果文件包含方括号且括号内的文本可被猜解，它将返回网站文档根目录下的任意文件。 cgiemail 目前随 cPanel 一起提供，默认启用。 示例 对于页面： root@kitploit: Success Processed form looks like this: ?php // http://hostname/login.php if$GET == 'admin' && $GET'pass' == 'thisissecure' /../ cgiemail 1.6...

bfac

BFAC 针对Web应用的高级备份文件工件测试 BFAC（备份文件工件检查器）是一种自动化工具，用于检查可能泄露Web应用源代码的备份工件。这些工件还可能导致敏感信息泄露，例如密码、目录结构等。 BFAC的目标是成为备份文件工件黑盒测试的 一体化工具 。 特性 多线程扫描。 包含请求速率限制。 HTTP代理支持。 使用多种算法自动检测有效和无效页面。 HTTP代理支持。 用户代理随机化。 批量处理。 既可作命令行工具，也可作Python模块。 支持Windows、macOS和Linux操作系统。 报告：简单、详细、CSV、JSON。 用法 描述| 命令 ---|--- 帮助| bfac...

Myesve

myesve Marco de explotación CVE-2024-38475 – Versión 1.0 Aviso legal: Esta herramienta está destinada únicamente a pruebas de seguridad autorizadas, investigación educativa y programas de bug bounty legítimos. No la utilice contra sistemas que no posea o para los que no tenga permiso explícito pa...

CVE-2024-40275_Scanner

Escáner CVE-2024-40725 Una herramienta de detección basada en Python para CVE-2024-40725 , una vulnerabilidad de divulgación de código fuente del servidor HTTP Apache que afecta a las versiones 2.4.0 y 2.4.61. Aviso legal: Ejecute este escáner únicamente contra servidores de su propiedad o para l...

CVE-2022-43959

CVE-2022-43959 Bitrix 漏洞 CVE-2022-43959 描述 1C-Bitrix Bitrix24 的 AD/LDAP 连接器模块（版本 23.100.0 之前）中，AD/LDAP 服务器设置内的凭据保护不足，允许远程管理员通过读取 /bitrix/admin/ldapserveredit.php 的源代码发现 AD/LDAP 管理密码。 CVSS 级别| 得分| CVSS| 链接 ---|---|---|--- 中等| 4.9| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N| 链接 复现步骤： 1. 获取 Bitrix...

CVE-2024-38475

CVE-2024-38475 POC 致谢 ：所有功劳归于这位人士：https://blog.orange.tw/ 和 https://x.com/orange8361，我所做的只是根据他的研究编写了一个POC脚本。 简介 ：Apache HTTP Server 2.4.59 及更早版本中 modrewrite 的输出转义不当，允许攻击者将 URL 映射到服务器允许提供但并非任何 URL 有意/直接可访问的文件系统位置，从而导致代码执行或源代码泄露。受影响的是服务器上下文中将反向引用或变量用作替换第一段的替换。某些不安全的 RewriteRules 会因这一变更而失效，重写标志...

EUVD-2026-63484

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

CVE-2026-6332

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it...

CVE-2026-6332

CVE-2026-6332 describes a plaintext storage of sensitive information vulnerability in Schneider Electric’s EcoStruxure Machine Expert HVAC platform. The issue centers on how sensitive data (potentially including protected source code) is stored, which could lead to confidentiality loss if an auth...

CVE-2026-6402

A flaw was found in webpack-dev-server. When the development server operates over plain HTTP, a remote attacker can exploit a cross-origin source code exposure vulnerability. This allows a malicious website, visited by a developer, to load the bundled application source code as a script and read ...

PT-2026-25834

Name of the Vulnerable Software and Affected Versions ChargePoint Home Flex affected versions not specified Description The ChargePoint Home Flex software contains an information disclosure issue. Sensitive information was included in the source code. The issue was discovered by Sina Kheirkhah of...