Browse / Node.js third-party modules

Node.js third-party modules

See its reports on the map

What gets reported to Node.js third-party modules

• Code Execution70
• Path Traversal63
• Cross-site Scripting49
• Denial of Service39
• Business Logic16
• Other weaknesses16

Most upvoted reports

AllValidInformativeN/ADuplicate

1. [http_server] Stored XSS in the filename when directories listingCross-site Scripting (XSS) - Stored · low
   61 votes
2. Server-Side Request Forgery (SSRF) in Ghost CMS Server-Side Request Forgery (SSRF) · medium
   43 votes
3. property-expr - Prototype pollutionModification of Assumed-Immutable Data (MAID) · high
   33 votes
4. [socket.io] Cross-Site Websocket Hijacking Cross-Site Request Forgery (CSRF) · high
   27 votes
5. Pixel flood attack cause the javascript heap out of memoryUncontrolled Resource Consumption · medium
   25 votes
6. Fastify denial-of-service vulnerability with large JSON payloadsUncontrolled Resource Consumption · critical
   25 votes
7. [Uppy] Internal Server side request forgery (bypass of #786956)Server-Side Request Forgery (SSRF) · critical
   23 votes
8. Server Side Request Forgery in Uppy npm moduleServer-Side Request Forgery (SSRF) · high
   22 votes
9. [takeapeek] XSS via HTML tag injection in directory lisiting pageCross-site Scripting (XSS) - Stored · medium
   21 votes
10. Prototype pollution attack (lodash)Allocation of Resources Without Limits or Throttling · high
    20 votes
11. [seeftl] Stored XSS when directory listing via filename.Cross-site Scripting (XSS) - Stored · medium
    20 votes
12. [glance] Access unlisted internal files/folders revealing sensitive informationInformation Exposure Through Directory Listing · high
    19 votes
13. bunyan - RCE via insecure command formattingCode Injection · high
    17 votes
14. [Total.js] Path traversal vulnerability allows to read files outside public directoryPath Traversal · medium
    16 votes
15. [buttle] Unsafe rendering of Markdown filesCross-site Scripting (XSS) - Generic · low
    16 votes
16. Reflected XSS in the npm module express-cart.Cross-site Scripting (XSS) - Reflected · medium
    16 votes
17. [logkitty] RCE via insecure command formattingCode Injection · high
    15 votes
18. Several simple remote code execution in pdf-imageCode Injection · critical
    15 votes
19. [tree-kill] RCE via insecure command concatenation (only Windows)Code Injection · high
    15 votes
20. [typeorm] SQL InjectionSQL Injection · high
    15 votes
21. [bower] Arbitrary File Write through improper validation of symlinks while package extractionPath Traversal · high
    15 votes
22. List any file in the folder by using path traversalPath Traversal · medium
    15 votes
23. Prototype pollution attack (lodash / constructor.prototype)Uncontrolled Resource Consumption · high
    15 votes
24. [pdfinfojs] Command Injection on filename parameterCommand Injection - Generic · high
    15 votes
25. [serve] Directory listing and File access even when they have been set to be ignored.Information Exposure Through Directory Listing · critical
    15 votes
26. [nested-property] Prototype PollutionModification of Assumed-Immutable Data (MAID) · medium
    14 votes
27. OS Command Injection on Jison [all-parser-ports]OS Command Injection · medium
    14 votes
28. [untitled-model] sql injectionSQL Injection · high
    14 votes
29. [ascii-art] Command injectionCommand Injection - Generic · high
    14 votes
30. Unrestricted file upload (RCE)Path Traversal · critical
    14 votes
31. [query-mysql] SQL Injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from databaseSQL Injection · critical
    14 votes
32. [serve] Access unlisted internal files/folders revealing sensitive informationInformation Exposure Through Directory Listing · critical
    13 votes
33. flatmap-stream malicious package (distributed via the popular events-stream)Embedded Malicious Code · critical
    13 votes
34. Code Injection Vulnerability in morgan PackageCode Injection · medium
    13 votes
35. [html-pages] Path Traversal in html-pages module allows to read any file from the server with curlPath Traversal · critical
    13 votes
36. [m-server] XSS reflected because path does not escapeHtmlCross-site Scripting (XSS) - Reflected
    12 votes
37. [htmr] DOM-based XSSCross-site Scripting (XSS) - DOM · medium
    12 votes
38. [express-laravel-passport] Improper AuthenticationImproper Authentication - Generic · high
    12 votes
39. [flintcms] Account takeover due to blind MongoDB injection in password resetPrivilege Escalation · critical
    12 votes
40. [buttle] Path traversal in mid-buttle module allows to read any file in the server.Path Traversal · critical
    12 votes
41. [hekto] Path Traversal vulnerability allows to read content of arbitrary filesPath Traversal · high
    12 votes
42. [i18next] Prototype pollution attackModification of Assumed-Immutable Data (MAID) · high
    11 votes
43. [devcert] Command Injection via insecure command formattingCommand Injection - Generic · critical
    11 votes
44. Prototype pollution in multipart parsingUncontrolled Resource Consumption · critical
    11 votes
45. Denial Of Service in Strapi Framework using argument injectionUncontrolled Resource Consumption · low
    11 votes
46. Application level denial of service due to shutting down the server Uncontrolled Resource Consumption · low
    11 votes
47. [fileview] Inadequate Output Encoding and Escaping Cross-site Scripting (XSS) - Stored · high
    11 votes
48. [simplehttpserver] List any file in the folder by using path traversal.Path Traversal · high
    11 votes
49. Privilege escalation allows any user to add an administratorPrivilege Escalation · critical
    11 votes
50. `memjs` allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usageUncontrolled Resource Consumption · critical
    11 votes
51. Prototype pollution attack (lodash)Uncontrolled Resource Consumption · low
    11 votes
52. [html-janitor] Bypassing sanitization using DOM clobberingBusiness Logic Errors · high
    11 votes
53. Prototype pollution in dot-propModification of Assumed-Immutable Data (MAID) · medium
    10 votes
54. gitlabhook OS Command InjectionOS Command Injection · critical
    10 votes
55. [http-file-server] Stored XSS in the filename when directories listingCross-site Scripting (XSS) - Stored · medium
    10 votes
56. Server Side JavaScript Code InjectionCode Injection · high
    10 votes
57. [apex-publish-static-files] Command Injection on connectStringCommand Injection - Generic · critical
    10 votes
58. [samsung-remote] Command injectionCommand Injection - Generic · critical
    10 votes
59. Command Injection Vulnerability in kill-port PackageCommand Injection - Generic · high
    10 votes
60. [hekto] open redirect when target domain name is used as html filename on serverOpen Redirect · low
    10 votes
61. `protobufjs` is vulnerable to ReDoS when parsing crafted invalid *.proto filesUncontrolled Resource Consumption · medium
    10 votes
62. [serve] Directory index of arbitrary folder available due to lack of sanitization of %2e and %2f characters in urlPath Traversal · critical
    10 votes
63. Bypass of SSRF VulnerabilityDuplicateServer-Side Request Forgery (SSRF) · high
    9 votes
64. Prototype Pollution lodash 4.17.15Uncontrolled Resource Consumption · high
    9 votes
65. Stored XSS (Hexo-admin plugin)Cross-site Scripting (XSS) - Stored · low
    9 votes
66. [webpack-bundle-analyzer] Cross-site ScriptingCross-site Scripting (XSS) - Generic · medium
    9 votes
67. Command Injection Vulnerability in libnmap PackageCommand Injection - Generic · medium
    9 votes
68. Prototype pollution attack (merge.recursive)Uncontrolled Resource Consumption · low
    9 votes
69. [statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browserCross-site Scripting (XSS) - Generic · medium
    9 votes
70. `whereis` concatenates unsanitized input into exec() commandCommand Injection - Generic · critical
    9 votes
71. [bracket-template] Reflected XSS possible when variable passed via GET parameter is used in templateCross-site Scripting (XSS) - Reflected · high
    9 votes
72. [localhost-now] Path Traversal allows to read content of arbitrary filePath Traversal · high
    9 votes
73. [general-file-server] Path Traversal vulnerability allows to read content on arbitrary file on the serverPath Traversal · high
    9 votes
74. [angular-http-server] Path Traversal in angular-http-server.js allows to read arbitrary file from the remote serverPath Traversal · high
    9 votes
75. Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDNHTTP Request Smuggling · medium
    8 votes
76. [cloudron-surfer] Denial of Service via LDAP InjectionLDAP Injection · critical
    8 votes
77. Server-side Template Injection in lodash.js InformativeCode Injection · high
    8 votes
78. SQL Injection or Denial of Service due to a Prototype PollutionSQL Injection · critical
    8 votes
79. [wireguard-wrapper] Command Injection via insecure command concatenationCommand Injection - Generic · critical
    8 votes
80. Path traversal using symlinkPath Traversal · high
    8 votes
81. [jsreport] Remote Code ExecutionRemote File Inclusion · high
    8 votes
82. Yarn transfers npm credentials over unencrypted http connectionMissing Encryption of Sensitive Data · high
    8 votes
83. [serve-here.js] List any file in the folder by using path traversal.Path Traversal · high
    8 votes
84. [min-http-server] List any file in the folder by using path traversal.Path Traversal · high
    8 votes
85. [atlasboard-atlassian-package] Cross-site Scripting (XSS)Cross-site Scripting (XSS) - Generic · low
    8 votes
86. Prototype pollution attack through jQuery $.extendModification of Assumed-Immutable Data (MAID) · medium
    8 votes
87. [knightjs] Path Traversal allows to read content of arbitrary filesPath Traversal · high
    8 votes
88. Command Injection is ps PackageCommand Injection - Generic · medium
    8 votes
89. url-parse package return wrong hostname Open Redirect · high
    8 votes
90. [markdown-pdf] Local file readingPath Traversal · medium
    8 votes
91. Insecure implementation of deserialization in cryoCode Injection · high
    8 votes
92. Remote code executio in NPM package getcookiesCode Injection · critical
    8 votes
93. [crud-file-server] Path Traversal allows to read arbitrary file from the serverPath Traversal · medium
    8 votes
94. [simplehttpserver] Stored XSS in file names leads to malicious JavaScript code execution when directory listing is output in HTMLCross-site Scripting (XSS) - Stored · critical
    8 votes
95. [@knutkirkhorn/free-space] - Command Injection through Lack of SanitizationCommand Injection - Generic · medium
    7 votes
96. [klona] Prototype pollutioncritical
    7 votes
97. [blamer] RCE via insecure command formattingCode Injection · high
    7 votes
98. [git-promise] RCE via insecure command formattingCode Injection · medium
    7 votes
99. [reveal.js] XSS by calling arbitrary method via postMessageCross-site Scripting (XSS) - DOM · medium
    7 votes
100. [http-file-server] List any files and sub folders in the folder by using path traversal.Path Traversal · high
     7 votes