gitjacker

gitjacker Gitjacker는 .git 디렉터리가 실수로 업로드된 사이트에서 git 저장소를 다운로드하고 그 내용을 추출합니다. 디렉터리 목록이 비활성화된 경우에도 저장소의 상당 부분을 복구할 수 있습니다. 교육용/침투 테스트용으로만 사용하십시오. 자세한 정보는 https://liam-galvin.co.uk/security/2020/09/26/leaking-git-repos-from-misconfigured-sites.html에서 확인하세요. 설치 curl -s...

React2P4IM0Nshell

React2P4IM0Nshell 💥Next.js 및 React Server ComponentsRSC 환경을 위한 고급 RCE/소스 누출/DoSCVE-2025-55182/83/84 감사 및 익스플로잇 확장 도구. 브라우저에서 직접 사용할 수 있으며, 확장 프로그램 내에 통합된 Linux 터미널로 리버스 셸을 수신합니다 ❌ ⚡ CMDCENTER: 핵심 👁️ 수동 정찰 DOM과 HTTP 헤더를 조용히 분석합니다. window.nextf 및 text/x-component와 같은 시그니처를 감지하여 WAF에 경고하지 않고 Next.js...

eos

Symfony의 적들 EOS EOS는 디버그 모드에서 Symfony 대상으로부터 정보를 약탈합니다: 섹션| 설명 ---|--- 일반| 대상에 대한 일반 정보를 가져옵니다. Phpinfo| 노출된 phpinfo에서 Symfony 환경 변수를 추출합니다. 라우트| 등록된 라우트 목록을 가져옵니다. 요청 로그| POST 요청 로그에서 자격 증명을 찾습니다. 프로젝트 파일| 워드리스트를 기반으로 프로젝트 파일구성, 데이터베이스 등을 검색합니다. 소스| 애플리케이션 소스 코드를 추출합니다. 쿠키| Remember Me 쿠키를 제작합니다...

CVE-2021-41773

CVE-2021-41773 Apache HTTP Server 2.4.49-2.4.50의 경로 정규화 변경에서 결함이 발견되었습니다. 공격자는 경로 탐색path traversal 공격을 이용해 URL을 예상 문서 루트document root 밖의 파일에 매핑할 수 있습니다. 문서 루트 외부의 파일이 "require all denied"로 보호되지 않으면 이러한 요청이 성공할 수 있습니다. 또한 이 결함은 CGI 스크립트와 같은 해석형interpreted 파일의 소스를 유출할 수 있습니다...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

Information Exposure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...

EUVD-2026-36421

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent incomplete fix for GHSA-6m52-m754-pw2g...

CVE-2026-49993

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...

CVE-2026-49993

Nuxt (Vue.js) users using the @nuxt/rspack-builder and @nuxt/webpack-builder are affected. The CVE concerns an incomplete fix for GHSA-6m52-m754-pw2g in versions 3.15.4–3.21.6 and 4.0.0–4.4.6, where the dev server could leak source code if bound to a non-loopback address and a malicious site is o...

PT-2026-48868

Name of the Vulnerable Software and Affected Versions @nuxt/rspack-builder versions 3.15.4 through 3.21.6 @nuxt/rspack-builder versions 4.0.0 through 4.4.6 @nuxt/webpack-builder versions 3.15.4 through 3.21.6 @nuxt/webpack-builder versions 4.0.0 through 4.4.6 Description An incomplete fix in the...

CVE-2026-48242: Use of Hard-coded Credentials

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials host, username, password, database name in importmdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values...

Exposed Dangerous Method or Function

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in Server.js, when handling non-HTTPS responses. An attacker can...

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence AI coding assistant, Claude Code, had been inadvertently released due to a human error. "No sensitive customer data or credentials were involved or exposed," an Anthropic spokesperson said in a statement...

Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

Cybersecurity researchers have disclosed a cross-site scripting XSS vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we...

CVE-2025-55183

A flaw was found in React Server Components RSC. This vulnerability allows an information leak, where a specifically crafted HTTP Hypertext Transfer Protocol request to a vulnerable Server Function can unsafely return its source code. Exploitation requires a Server Function that explicitly or...

EUVD-2019-8562

Malware in sbrugna...

EUVD-2023-39050

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-3413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions...

ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure

Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators' infrastructure. "The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft...