htcap

HTCAP htcap은 싱글 페이지 애플리케이션SPA을 재귀적으로 크롤링할 수 있는 웹 애플리케이션 스캐너로, Ajax 호출과 DOM 변경을 가로챕니다. 주요 기능 재귀적 DOM 크롤링 엔진 ajax/fetch/jsonp/websocket 요청 발견 쿠키, 프록시, 사용자 정의 헤더, HTTP 인증 등 지원 텍스트 유사성을 기반으로 하는 휴리스틱 페이지 중복 제거 엔진 스크립트 가능한 로그인 시퀀스 모든 발견 사항은 sqlite 데이터베이스에 저장되며 대화형 HTML 보고서로 내보낼 수 있습니다. 내장된 퍼저는 SQL 인젝션,...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

domdig

DOMDig DOMDigは、Chromiumウェブブラウザ内で動作するDOM XSSスキャナであり、シングルページアプリケーション（SPA）を再帰的にスキャンできます。 他のスキャナとは異なり、DOMDigはDOMの変更やXHR/fetch/websocketリクエストを追跡することで、あらゆるウェブアプリケーション（gmailを含む）をクロールでき、イベントを発火させることで実際のユーザー操作をシミュレートできます。このプロセス中に、XSSペイロードが入力フィールドに挿入され、その実行が追跡されることで、インジェクションポイントと関連するURLの変更が特定されます。...

DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

React Router へようこそ！ React Router を使用したフルスタック React アプリケーション構築のための、現代的で本番環境に即したテンプレートです。 特徴 🚀 サーバーサイドレンダリング ⚡️ ホットモジュールリプレースメント HMR 📦 アセットのバンドルと最適化 🔄 データのロードとミューテーション 🔒 デフォルトで TypeScript 🎉 スタイリング用 TailwindCSS 📖 React Router ドキュメント はじめに インストール 依存関係をインストール: npm install 開発 HMR 対応の開発サーバーを起動: npm run de...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2023-43149

CVE-2023-43149 작성자 : Aitor Herrero Fuentes 공급업체: SPA-Cart 공급업체 홈페이지: https://spa-cart.com/ 소프트웨어 링크: https://demo.spa-cart.com/admin 버전: 1.9.0.3 테스트 환경: Windows 10 Pro CSRF 루트 계정 추가 애플리케이션 demo.spa-cart.com의 교차 사이트 요청 위조 취약점으로 인해 원격 공격자가 임의의 코드를 실행하고, "role status"를 가진 악성 사용자를 한 번의 클릭으로 추가할 수 있습니...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

wix-kickstartx-challenge-writeup

Wix KickstartX Challenge 2026 — 전체 라이트업 결과: 200/200 100% — 토큰: WKX-9245FA70-200 날짜: 2026년 3월 24일 1. 발견 및 정찰 챌린지 공지 LinkedIn 게시물을 통해 주니어 개발자 프로그램인 Wix KickstartX를 위한 특별 챌린지가 공지되었습니다. 규칙: 30분, 단 한 번의 시도만 허용 상위 10명의 최고 점수자는 시험 단계로 직접 진출 두 개의 링크 제공: wix-kickstartx-challenge-2026.base44.app/ 및...

CVE-2023-43148

CVE-2023-43148 작성자 : Aitor Herrero Fuentes 공급업체: SPA-Cart 공급업체 홈페이지: https://spa-cart.com/ 소프트웨어 링크: https://demo.spa-cart.com/admin 버전: 1.9.0.3 테스트 환경: Windows 10 Pro CSRF 모든 계정 삭제 demo.spa-cart.com 애플리케이션의 사이트 간 요청 위조CSRF 취약점은 원격 공격자가 임의 코드를 실행하고 한 번의 클릭으로 '모든 계정'을 삭제할 수 있게 합니다. CSRF 취약점은 악의적인...

PT-2026-94122

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description An issue exists in the per-object authorization mechanism involving the get object and has object permission functions. While authorization was enforced on WebSocket mount and event paths, it was missi...

Astra Linux – Vulnerability in exim4

In Exim versions before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be a vulnerability where an out-of-bounds write could cause the connection instance to crash, or erroneous data processing could lead to data being leaked from uninitialized heap...

WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...

CVE-2026-10595

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

Malicious code in devplatform-spa-plugin-s3-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflar...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

Malicious code in devplatform-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ea05a85bad5f3af2ead77745d792c055efc94b9b58726fe3ee499821c745c On require'devplatform-spa', index.js loads loader.js which downloads an OS-specific binary from Cloudflare Workers endpoints whose hostnames are...

MAL-2026-12754 Malicious code in devplatform-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ea05a85bad5f3af2ead77745d792c055efc94b9b58726fe3ee499821c745c On require'devplatform-spa', index.js loads loader.js which downloads an OS-specific binary from Cloudflare Workers endpoints whose hostnames are...

Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12755 Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12770 Malicious code in devplatform-spa-plugin-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78 On require of the package, index.js loads vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct...