sj

sj Swagger Jacker sj è uno strumento da riga di comando progettato per assistere nell'audit dei file di definizione Swagger/OpenAPI esposti, verificando gli endpoint API associati alla ricerca di autenticazione debole. Fornisce inoltre modelli di comandi per il test manuale delle vulnerabilità. L...

restler-fuzzer

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI formerly Swagger specification, RESTler analyzes its...

WordPress API Bearer Auth <20190907 - Cross-Site Scripting

WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php. id: CVE-2019-16332 info: name: WordPress API Bearer Auth 20190907 - Cross-Site Scripting author: daffainfo severity: medium...

WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting

WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page. id:...

Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

Mailcow Dockerized Swagger UI - Cross-Site Scripting

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI before 4.11.1 that is affected by a DOM-based Cross-Site Scripting XSS vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

apidetector

APIDetector è uno strumento potente ed efficiente progettato per testare gli endpoint Swagger esposti in vari sottodomini, con capacità intelligenti uniche per rilevare falsi positivi. È particolarmente utile per i professionisti della sicurezza e gli sviluppatori impegnati nel test delle API e...

CVE-2018-25031

CVE-2018-25031 Beschreibung: Swagger UI vor 4.1.3 könnte es einem entfernten Angreifer ermöglichen, Spoofing-Angriffe durchzuführen. Indem er ein Opfer dazu überredet, eine manipulierte URL zu öffnen, könnte ein Angreifer diese Schwachstelle ausnutzen, um entfernte OpenAPI-Definitionen anzuzeigen...

CVE-2018-25031

CVE-2018-25031 CVE-2018-25031 Exploit-Tests Swagger UI vor Version 4.1.3 könnte es einem entfernten Angreifer ermöglichen, Spoofing-Angriffe durchzuführen. Indem er ein Opfer dazu überredet, eine manipulierte URL zu öffnen, könnte ein Angreifer diese Sicherheitslücke ausnutzen, um entfernte...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI prima della 4.1.3 Un semplice POC CVE-2018-25031 che induce la vittima a inserire il codice di autorizzazione, che viene poi inviato all'attaccante. Puoi usarlo con la vulnerabilità XSS https://github.com/VictorNS69/swagger-ui-xss È necessario trovare il parametro e...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

Source: amazon-inspector 605d8d8afe172d78840f3617c35733b47635a3482beba461bc1015c45840e250 The package presents itself as a NestJS Swagger integration name resembles @nestjs/swagger, published at version 999.0.2 in a dependency-confusion shape but ships a stub JavaScript API forRoot/createLogger...

test-xss-swagger-CVE-2019-1749

Dieses Repository hat keine README-Datei...

CVE-2018-25031

POC de Cross-Site Scripting no Swagger UI: CVE-2018-25031 utilizando Selenium em Python Este repositório contém um script em Python que demonstra uma prova de conceito POC de uma vulnerabilidade de Cross-Site Scripting XSS no Swagger UI, usando a biblioteca Selenium. O objetivo dessa POC é...

CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Descrizione : Questo repository contiene un exploit Proof‑of‑Concept PoC per CVE‑2025‑8191, una vulnerabilità trovata in Swagger UI. La vulnerabilità permette un'iniezione Cross‑Site Scripting XSS nel campo "description", portando all'esecuzione remota di...

SwaggerUI-CVE-2018-25031

Exploit für Swagger UI - CVE-2018-25031 Exploit für Swagger UI – Fehldarstellung kritischer Informationen in der Benutzeroberfläche UI CVE-2018-25031. Dieses Exploit prüft, ob die verwendete Swagger-UI für die Ausnutzung der Schwachstelle „Fehldarstellung kritischer Informationen in der...

swagger-ui

Introduzione: Il ruolo di Swagger UI Swagger UI è una libreria ampiamente utilizzata che rende le specifiche OpenAPI precedentemente Swagger in un'interfaccia web interattiva. Consente a sviluppatori e integratori di esplorare e testare le API senza avere l'implementazione backend in atto. Dettag...