Filip Maňas D365 F&O MCP Server configuration error vulnerability

A security vulnerability exists in Filips Maňas D365 F&O MCP Server versions prior to 1.11.0. This vulnerability arises because Azure One-Click Deployment defaults to setting apiKey to an empty value. When APIKEY is not set or is empty, authentication is not performed. Additionally, HTTP listenin...

CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

Phalcon Framework - Source Code Leakage Detection

Phalcon Framework source code was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Phalcon Framework source code was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Phalcon Framework - Source Code...

Rstudio Shiny Server <1.5.16 - Local File Inclusion Detection

Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Rstudio Shiny Server prior to 1.""" import re from kittysploit import from...

CVE-2026-45670

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack /...

GHSA-6M52-M754-PW2G Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Summary This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address e.g. nuxt dev --host and the developer opens a malicious site on the same network. Details The fix for...

CVE-2025-56647

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development hot module reloading server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leake...

CVE-2025-56647

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development hot module reloading server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leake...

CVE-2025-56647

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development hot module reloading server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leake...

Parcel has an Origin Validation Error vulnerability

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a --no-cors option which disables CORS...

Vivotek's various products have security vulnerabilities

Vivotek ND8422P and others are a network camera from China VIVOTEK Communications Vivotek. A security vulnerability exists in various Vivotek products, which originated from causing sensitive information to be included in the source code. The following products are affected: Vivotek ND8422P,...

SUSE CVE-2024-47166

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

Vulnerabilities fixed in Apache HTTP Server

Two vulnerabilities have been fixed in Apache HTTP server 2.4. The first vulnerability CVE-2024-40725 can lead to source code leakage when files are accessed indirectly. The second vulnerability CVE-2024-40898 involves a Server Side Request Forgery SSRF that can be abused by a malicious person to...

CVE-2022-34002

The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-privileged authenticated attacker to leak the configuration files and source code of the web application...

Simple Attendance System 1.0 - Authenticated bypass Vulnerability

Exploit Title: Simple Attendance System 1.0 - Authenticated bypass Exploit Author: Abdullah Khawaja hax.3xploit Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html Software Link:...

CVE-2021-25764: Undefined Security Weakness

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs...

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

CVE-2019-14365

The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

X (Formerly Twitter): [staging-engineering.gnip.com] Publicly accessible GIT directory

Steps to reproduce: Open http://staging-engineering.gnip.com/.git/logs/refs/heads/master Publicly accessible GIT directory сan lead to leakage of source code and other private information...

Slack: Source code leakage through GIT web access at host '52.91.137.42'

@d0znpp alerted us to the public availability of Git files on a QA server. This lead to the access to files which should have been restricted. We have enforced proper access control, and Slack awarded @d0znpp a $1,500 bounty for bringing the issue to our attention! Thank you!...