svn-extractor

Svn-Extractor Многие тестировщики веб-приложений сталкиваются с наличием папок .svn. Для тех, кто не знает, папка .svn используется системой контроля версий SVN для выполнения своих операций. При черном ящике blackbox pentest эта папка содержит огромное количество информации. Вот некоторые ключев...

CVE-2025-55183

CVE-2025-55183 Scanner pour la vulnérabilité d'exposition du code source des Server Functions React. Qu'est-ce que c'est ? CVE-2025-55183 : Les Server Actions de React 19.0.0-19.2.1 peuvent être exploitées pour exposer l'intégralité de leur code source, y compris les secrets codés en dur, les clé...

nextjs-security-update

nextjs-security-update Il y a des personnes qui construisent des outils OSS pour exploiter les nouvelles vulnérabilités de Next.js. Cet outil permet de riposter - il rend incroyablement simple la mise à jour de toutes vos applications Next.js sur l'ensemble de vos comptes GitHub. Utilise l'outil ...

react-server-cve-lab

Laboratoire de Sécurité des Composants Serveur React CVE-2025-55183 & CVE-2025-55184 Un environnement de test de sécurité complet pour les vulnérabilités CVE-2025-55183 Exposition de code source et CVE-2025-55184 Déni de service dans les Composants Serveur React. ⚠️ Avertissement À USAGE UNIQUEMEN...

CVE-2024-38475

CVE-2024-38475 эксплойт CVE-2024-38475уязвимость modrewrite с сопоставлением путей файловой системы Этот репозиторий содержит Python-скрипт для тестирования уязвимостей веб-серверов, в частности Apache. Скрипт проверяет потенциальные проблемы уязвимость modrewrite с сопоставлением путей файловой...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

CVE-2026-61782

The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-84149

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

EUVD-2026-69059

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

PT-2026-84201

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and earlier, the CVE-2026-16581 describes an Inclusion of Sensitive Information in Source Code that could allow an unauthorized actor to access functions or backend services not sufficiently protected by authentication controls. The affected softw...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...