// 漏洞聚焦
FixVibe 运行的每一项检查,
通通讲清楚。
FixVibe 自带 164+ 个漏洞类别。每条记录每次扫描最多运行 35 项子检查,详细讲解漏洞如何工作、攻击者能从中得到什么、我们如何检测以及如何防御。
01 / 07
HTTP 与表面
02 / 07
密钥
硬编码密钥模式
Stripe 密钥、AWS 凭据、OpenAI token——模式匹配能抓到那些容易犯的错误。
阅读聚焦 →
JavaScript 包中的密钥
如果它进入了你的客户端 bundle，那就不是密钥——是公开声明。
阅读聚焦 →
JWT 完整性 (alg 混淆、弱密钥)
如果你的 JWT 验证器信任 token 自己的 header，攻击者写什么它就信什么。
阅读聚焦 →
浏览器存储中的 Token
localStorage 是 JavaScript 可读的。存在那里的认证 token 在设计上就是 XSS 可窃取的。
阅读聚焦 →
暴露的 Source Maps
如果你的 .map 文件公开可访问，攻击者正在阅读你的 TypeScript。
阅读聚焦 →
JavaScript 中的信息泄露
内部 API 主机、版本横幅、TODO 注释——小泄露累积成你技术栈的地图。
阅读聚焦 →
03 / 07
Backend-as-a-Service
Firebase 安全规则
`allow read, write: if true` 此刻就是某个人的生产数据库。
阅读聚焦 →
Supabase 行级安全
如果不在每张公开表上启用 RLS，你的 anon key 就是任意读取的通行证。
阅读聚焦 →
Clerk 和 Auth0 配置
身份提供商在默认值未收紧时泄露超出应有水平。
阅读聚焦 →
Supabase Storage and API Posture
Public buckets and anon-listable objects are where BaaS data leaks start.
阅读聚焦 →
04 / 07
DNS
05 / 07
探索
Arcserve UDP Heap Overflow Advisory
Backup management consoles should not expose affected UDP versions.
阅读聚焦 →
Schneider Modicon M221 Firmware Advisory
PLC firmware evidence should drive patch and segmentation review, not reboot or authentication replay tests.
阅读聚焦 →
CVE 交叉比对
检测到的版本 + 公开 CVE 数据库 = 已经记录在案的攻击清单。
阅读聚焦 →
Debug 和管理员端点
/debug、/admin、/server-status——这些路径不应该从互联网可达。
阅读聚焦 →
暴露的文件和备份目录
.env、.git、.DS_Store、backup.sql——这些不该公开的文件意外公开了。
阅读聚焦 →
Rockwell MicroLogix 1100 DoS Advisory
An exposed PLC fingerprint is an operations risk, not something to crash-test.
阅读聚焦 →
SPIP Template RCE Version Exposure
Public SPIP version banners can reveal an RCE-class patch gap.
阅读聚焦 →
Checking Apache ActiveMQ Artemis for CVE-2023-50780
Checking Apache ActiveMQ Artemis for CVE-2023-50780
阅读聚焦 →
Checking Apache Airflow for CVE-2024-45498
Checking Apache Airflow for CVE-2024-45498
阅读聚焦 →
Checking Apache Tomcat for CVE-2020-11996
Checking Apache Tomcat for CVE-2020-11996
阅读聚焦 →
Checking Claude Code GitHub Action workflow permissions
Checking Claude Code GitHub Action workflow permissions
阅读聚焦 →
Checking codexui-android for token-stealing package versions
Checking codexui-android for token-stealing package versions
阅读聚焦 →
Checking cordova-plugin-inappbrowser for CVE-2019-0219
Checking cordova-plugin-inappbrowser for CVE-2019-0219
阅读聚焦 →
Checking DICOM files for executable preambles
Checking DICOM files for executable preambles
阅读聚焦 →
Checking Django for CVE-2011-0696
Checking Django for CVE-2011-0696
阅读聚焦 →
Checking Drupal Core for CVE-2026-9082
Checking Drupal Core for CVE-2026-9082
阅读聚焦 →
Checking easy-day-js for Mastra npm incident package evidence
Checking easy-day-js for Mastra npm incident package evidence
阅读聚焦 →
Checking Keras for CVE-2025-1550
Checking Keras for CVE-2025-1550
阅读聚焦 →
Checking Langflow CORS exposure for CVE-2025-34291
Checking Langflow CORS exposure for CVE-2025-34291
阅读聚焦 →
Checking Log4j 1.2 JDBCAppender for CVE-2022-23305
Checking Log4j 1.2 JDBCAppender for CVE-2022-23305
阅读聚焦 →
Checking MindsDB version exposure for CVE-2026-27483
Checking MindsDB version exposure for CVE-2026-27483
阅读聚焦 →
Checking MISP STIX import source for CVE-2018-19908
Checking MISP STIX import source for CVE-2018-19908
阅读聚焦 →
Checking Moby/Docker Go modules for CVE-2026-34040
Checking Moby/Docker Go modules for CVE-2026-34040
阅读聚焦 →
Checking NGINX rewrite configurations for CVE-2026-42945
Checking NGINX rewrite configurations for CVE-2026-42945
阅读聚焦 →
Checking NiceGUI upload source for CVE-2026-25732
Checking NiceGUI upload source for CVE-2026-25732
阅读聚焦 →
Checking Nokogiri for CVE-2019-18197
Checking Nokogiri for CVE-2019-18197
阅读聚焦 →
Checking npm lockfiles for known typosquat package versions
Checking npm lockfiles for known typosquat package versions
阅读聚焦 →
Checking ONNX for CVE-2024-5187
Checking ONNX for CVE-2024-5187
阅读聚焦 →
Checking Paramiko for CVE-2018-7750
Checking Paramiko for CVE-2018-7750
阅读聚焦 →
Checking proxy npm package for CVE-2023-2968
Checking proxy npm package for CVE-2023-2968
阅读聚焦 →
Checking Spring Data Commons and XMLBeam for CVE-2018-1259
Checking Spring Data Commons and XMLBeam for CVE-2018-1259
阅读聚焦 →
Checking SQLitePCLRaw native SQLite packages for CVE-2025-6965
Checking SQLitePCLRaw native SQLite packages for CVE-2025-6965
阅读聚焦 →
Checking vLLM for CVE-2024-9053
Checking vLLM for CVE-2024-9053
阅读聚焦 →
Checking WordPress REST API user exposure
Checking WordPress REST API user exposure
阅读聚焦 →
Checking YOURLS for CVE-2019-14537
Checking YOURLS for CVE-2019-14537
阅读聚焦 →
Cloudflare 源站和代理姿态
如果你的源站 IP 可被发现，Cloudflare 的 WAF 就可被绕过。
阅读聚焦 →
GraphQL Introspection 暴露
生产环境的 introspection 把整个类型系统直接交给攻击者。
阅读聚焦 →
威胁情报交叉比对
Spamhaus DBL、URLhaus——从外部看你的域名信誉。
阅读聚焦 →
暴露的 API 文档
/swagger.json、/openapi.json、/docs——给你也给攻击者用的公开 API 地图。
阅读聚焦 →
Netlify 特有的暴露
Netlify deploy preview URL、x-nf-* 头、_redirects 配置错误。
阅读聚焦 →
隐私和 Cookie 合规标记
GDPR 要求的页面——必须存在并被链接，否则有被投诉的风险。
阅读聚焦 →
技术栈指纹识别
了解你的技术栈是侦察的一半——过时的框架补完另一半。
阅读聚焦 →
Vercel 特有的暴露
_next/static、x-vercel-* 头、preview URL——Vercel 特有的痕迹泄露超出预期。
阅读聚焦 →
06 / 07
主动探测
AVideo Command Injection Advisory
An outdated AVideo Composer dependency can expose video-link import paths to command execution risk.
阅读聚焦 →
跨租户数据泄露
没有租户 ID 强制的多租户 SaaS 会在组织间泄露客户数据。
阅读聚焦 →
GeniXCMS Author SQL Injection Exposure
A legacy CMS author filter should not turn one parameter into SQL syntax.
阅读聚焦 →
JWT alg=none Acceptance
A decoded token is not an authenticated identity.
阅读聚焦 →
MagicMirror /cors SSRF Exposure
A smart-mirror helper endpoint should not become a network proxy.
阅读聚焦 →
Moxa NPort Firmware Advisory
A public device-server firmware banner should drive an upgrade, not a crash test.
阅读聚焦 →
操作系统命令注入
当用户输入成为 shell 命令的一部分，shell 就执行攻击者写的任何东西。
阅读聚焦 →
rclone RC Authentication Exposure
A public rclone Remote Control API should not answer unauthenticated fsinfo requests.
阅读聚焦 →
服务端模板注入 (SSTI)
模板引擎把用户输入当作模板时，服务器就把用户输入当作代码。
阅读聚焦 →
SiteOmat BOS Authentication Advisory
Fuel-station management software needs version and exposure review, not password guessing.
阅读聚焦 →
SiteOmat CGI Buffer Overflow Advisory
Fuel-station controller CGI risk needs patch and exposure review, not exploit probes.
阅读聚焦 →
SiteOmat Login SQL Injection Advisory
Fuel-station login risk needs patch and exposure review, not authentication-bypass probes.
阅读聚焦 →
SQL 注入
当用户输入成为查询的一部分，数据库就不再属于你。
阅读聚焦 →
认证流程缺陷
登录、注册、密码重置——大多数账号接管实际上就发生在这。
阅读聚焦 →
盲 SSRF (带外)
如果服务器抓取用户提供的 URL，用户就能让它去抓内部服务。
阅读聚焦 →
CKAN DataStore SQL Authorization Bypass
Public DataStore SQL access can turn open data APIs into private data exposure.
阅读聚焦 →
CORS 配置错误
宽松的 Access-Control-Allow-Origin 加上凭据，意味着你的 API 是所有人的 API。
阅读聚焦 →
通过 URL 片段的 DOM 型 XSS
现代 SPA 读取 location.hash 并写入 DOM——攻击者的 payload 一路同行。
阅读聚焦 →
文件上传校验
用户上传的文件是任意字节——不检查就当“图片”接受是在邀请 RCE。
阅读聚焦 →
FUXA Hardcoded JWT Fallback Secret
Default token-signing secrets can turn an HMI login into a weak boundary.
阅读聚焦 →
GL.iNet GL-MT3000 Firmware Advisory
A router firmware match should drive an upgrade, not a command-execution test.
阅读聚焦 →
GraphQL 深度轰炸和批量绕过
GraphQL 的灵活性也是它的脆弱点——深度炸弹、别名批处理、字段建议泄露。
阅读聚焦 →
HTTP 请求走私
前端代理和后端对一个请求在哪结束意见不一致——攻击者就在缝隙间穿行。
阅读聚焦 →
IDOR / BOLA
如果你的 API 信任客户端发送正确的 ID，客户端就能发送任何 ID。
阅读聚焦 →
IIS TRACK Method Information Disclosure
Legacy HTTP method echo behavior should be disabled before it can expose request headers.
阅读聚焦 →
Liferay Portal Template RCE Advisory
Legacy Liferay Portal version evidence should trigger patch verification.
阅读聚焦 →
LLM 提示注入
如果你的 AI 功能把用户输入当作指令信任，用户就能改写系统提示。
阅读聚焦 →
NoSQL 操作符注入
用户控制的 JSON 中的 MongoDB 风格操作符把你的查询变成通配符。
阅读聚焦 →
反射型跨站脚本攻击 (XSS)
无声的劫持：一个未经处理的参数就能在你用户的浏览器里执行攻击者代码。
阅读聚焦 →
Rockwell MicroLogix 1100 Authentication Advisory
Firmware evidence should drive an update and exposure review, not password-guessing tests.
阅读聚焦 →
XML 外部实体 (XXE)
如果你的 XML 解析器解析外部实体，你的服务器就在为攻击者读文件。
阅读聚焦 →
ZoneMinder Directory Listing Exposure
A camera management UI should not publish its web root index.
阅读聚焦 →
账号枚举
如果登录在邮箱存在与否时返回不同响应，攻击者就能构建客户名单。
阅读聚焦 →
Checking gemini-mcp-tool for CVE-2026-0755
Checking gemini-mcp-tool for CVE-2026-0755
阅读聚焦 →
Checking Label Studio upload-example XSS exposure
Checking Label Studio upload-example XSS exposure
阅读聚焦 →
Checking Langflow version exposure for CVE-2026-33017
Checking Langflow version exposure for CVE-2026-33017
阅读聚焦 →
Checking PowerLogic EGX exposure for CVE-2021-22765/CVE-2021-22767/CVE-2021-22768
Checking PowerLogic EGX exposure for CVE-2021-22765/CVE-2021-22767/CVE-2021-22768
阅读聚焦 →
Checking TLS endpoints for RC4 support
Checking TLS endpoints for RC4 support
阅读聚焦 →
Checking TLS endpoints for Sweet32 DES/3DES support
Checking TLS endpoints for Sweet32 DES/3DES support
阅读聚焦 →
Confirming Glances REST API unauthenticated exposure
Confirming Glances REST API unauthenticated exposure
阅读聚焦 →
Confirming Next.js middleware bypass exposure
Confirming Next.js middleware bypass exposure
阅读聚焦 →
Confirming SillyTavern SearXNG external-fetch SSRF exposure
Confirming SillyTavern SearXNG external-fetch SSRF exposure
阅读聚焦 →
Confirming TMT Lockcell login SQL injection exposure
Confirming TMT Lockcell login SQL injection exposure
阅读聚焦 →
CRLF / 响应拆分
如果用户输入落入响应头，换行符让攻击者写入自己的头部。
阅读聚焦 →
CSRF 防护
如果你的状态变更端点不要求 CSRF token，第三方网站就能以你的用户身份行动。
阅读聚焦 →
缺失速率限制
认证端点没有速率限制，攻击者可以以线路速度做凭据填充。
阅读聚焦 →
Next.js Header Configuration Drift
Headers set on `/` do not always protect nested routes.
阅读聚焦 →
开放重定向
你那个不验证目的地的 /redirect?url=… 就是个钓鱼套件。
阅读聚焦 →
SPIP valider_xml XSS Exposure
A legacy SPIP utility page should not reflect URL input into HTML.
阅读聚焦 →
07 / 07
源代码
deephas Prototype-Pollution Advisory
A vulnerable deephas dependency can put deep-path object handling on a prototype-pollution path.
阅读聚焦 →
Ghost Content API SQL Injection Advisory
A vulnerable Ghost dependency can put public content APIs on the database boundary.
阅读聚焦 →
LibreNMS Command Injection Advisory
A vulnerable monitoring stack can become an execution path inside the network.
阅读聚焦 →
LiteLLM SQL Injection Advisory
A vulnerable LiteLLM Proxy version can turn API-key verification into database exposure.
阅读聚焦 →
NLTK Zip Slip Code Execution Advisory
A vulnerable NLTK downloader can turn compromised package archives into filesystem writes and code-execution risk.
阅读聚焦 →
openDCIM Command Injection Source Advisory
A database-controlled Graphviz path should not become a shell command.
阅读聚焦 →
TanStack ArkType Adapter Malware Advisory
Known malicious npm package versions can put CI and developer secrets at install-time risk.
阅读聚焦 →
vm2 Sandbox Breakout Advisory
A vulnerable JavaScript sandbox dependency can put untrusted-code boundaries at risk.
阅读聚焦 →
Apache Tomcat Coyote Resource-Shutdown Advisory
An affected Tomcat HTTP/2 runtime can turn reset behavior into resource exhaustion.
阅读聚焦 →
Apache Tomcat EncryptInterceptor Advisory
Exact affected Tomcat releases need an upgrade before cluster encryption assumptions are trusted.
阅读聚焦 →
Apache Tomcat h2c Request Mix-Up Advisory
Affected Tomcat h2c handling can put request data on the wrong response path.
阅读聚焦 →
Apache Tomcat Session-Persistence Advisory
Affected Tomcat runtimes become riskier when FileStore session persistence is enabled.
阅读聚焦 →
Committed AI-Generated Secrets
AI snippets should not ship provider keys into git.
阅读聚焦 →
Compromised codfish GitHub Action
Release workflows should not keep pointing at compromised Action refs.
阅读聚焦 →
electerm Install-Script Command Injection Advisory
A vulnerable terminal-client dependency can put build or developer hosts at install-time risk.
阅读聚焦 →
electerm Unauthorized Command Execution Advisory
A stale electerm package can matter when the vulnerable service is packaged and running.
阅读聚焦 →
Gogs Directory Traversal Dependency Advisory
An affected Gogs runtime can put file-upload path handling on a traversal boundary.
阅读聚焦 →
Gradio Windows Python Path Traversal Advisory
A vulnerable Gradio dependency becomes a stronger signal when repo config points to Windows with Python 3.13+.
阅读聚焦 →
Mbed TLS Buffer-Overflow Advisory
Affected Mbed TLS 3.x source evidence deserves an upgrade, not exploit reproduction.
阅读聚焦 →
Mbed TLS Double-Free Advisory
Legacy Mbed TLS version evidence deserves branch-aware remediation.
阅读聚焦 →
Microsoft ATL MS09-035 Source Advisory
Legacy ATL build metadata deserves rebuild proof, not exploit reproduction.
阅读聚焦 →
OpenCms XXE Information-Disclosure Advisory
A vulnerable OpenCms dependency can put XML-processing routes on a file-read boundary.
阅读聚焦 →
OpenSSL CMS Message-Parsing Advisory
Affected OpenSSL branch evidence deserves a branch-aware runtime upgrade.
阅读聚焦 →
PDF.js JavaScript Execution Advisory
A vulnerable PDF viewer can turn a malicious document into script execution.
阅读聚焦 →
PickleScan ZIP CRC Bypass Advisory
A vulnerable PickleScan dependency can miss malicious model archives when scans fail open.
阅读聚焦 →
pyLoad /flashgot RCE Advisory
A vulnerable pyLoad dependency is patch-triage evidence, not proof of live RCE.
阅读聚焦 →
高风险源码模式
eval()、dangerouslySetInnerHTML、硬编码密钥——SAST 抓了 25 年的模式。
阅读聚焦 →
SaltStack Salt Directory Traversal Advisory
A vulnerable Salt package can weaken Salt master authentication boundaries.
阅读聚焦 →
SAP Cloud SDK for AI Python Advisory
A vulnerable SAP Python SDK dependency is patch-triage evidence, not proof of live command execution.
阅读聚焦 →
Spring Data Commons Resource-Exhaustion Advisory
Affected Spring Data Commons dependencies can put property-path parsing on a DoS path.
阅读聚焦 →
Supabase RLS in Migrations
A public table without RLS is a future data leak.
阅读聚焦 →
veraPDF XSLT Injection Dependency Advisory
Affected veraPDF policy-file processing can put XSLT execution boundaries at risk.
阅读聚焦 →
易受攻击的依赖
你的 package-lock.json 包含数千个包。其中一些有已知 CVE。
阅读聚焦 →
Webhook 签名验证
如果你的 webhook handler 不验证签名，任何人都能伪造事件。
阅读聚焦 →
ws Excessive-Header DoS Advisory
Affected ws server runtimes can crash when upgrade requests carry too many headers.
阅读聚焦 →
AI-Generated Code Guardrails
Fast AI-assisted changes need repo-level security rails.
阅读聚焦 →
Checking @andrei-tatar/nora-firebase-common for CVE-2024-30564
Checking @andrei-tatar/nora-firebase-common for CVE-2024-30564
阅读聚焦 →
Checking Apache ActiveMQ Artemis for CVE-2026-27446
Checking Apache ActiveMQ Artemis for CVE-2026-27446
阅读聚焦 →
Checking Apache Spark for CVE-2022-33891
Checking Apache Spark for CVE-2022-33891
阅读聚焦 →
Checking Cargo files for the malicious onering crate
Checking Cargo files for the malicious onering crate
阅读聚焦 →
Checking http4k-format-xml for CVE-2024-55875
Checking http4k-format-xml for CVE-2024-55875
阅读聚焦 →
Checking kill-port-process for CVE-2019-15609
Checking kill-port-process for CVE-2019-15609
阅读聚焦 →
Checking Log4j 1.2 JMSAppender for CVE-2021-4104
Checking Log4j 1.2 JMSAppender for CVE-2021-4104
阅读聚焦 →
Checking Note Mark backend for CVE-2026-44522
Checking Note Mark backend for CVE-2026-44522
阅读聚焦 →
Checking npm package versions and binding.gyp for the Phantom Gyp worm
Checking npm package versions and binding.gyp for the Phantom Gyp worm
阅读聚焦 →
Checking OpenSSL PowerPC builds for CVE-2023-6129
Checking OpenSSL PowerPC builds for CVE-2023-6129
阅读聚焦 →
Checking Perl GD for CVE-2026-11526
Checking Perl GD for CVE-2026-11526
阅读聚焦 →
Checking Red Hat npm package versions for the worm campaign
Checking Red Hat npm package versions for the worm campaign
阅读聚焦 →
Checking WebdriverIO BrowserStack service for CVE-2026-25244
Checking WebdriverIO BrowserStack service for CVE-2026-25244
阅读聚焦 →
Kubernetes Service ExternalIPs Advisory
ExternalIPs in Service manifests deserve RBAC and admission-policy review.
阅读聚焦 →
Mbed TLS Certificate-Validation Advisory
Affected Mbed TLS 3.x evidence deserves upgrade and client-auth review.
阅读聚焦 →
OpenSSL TLSv1.3 Session Memory-Growth Advisory
A vulnerable OpenSSL runtime plus no-ticket TLSv1.3 session handling can create DoS risk.
阅读聚焦 →
Oracle Java SE / GraalVM Runtime Advisory
Affected Oracle runtime metadata deserves an update, not DoS reproduction.
阅读聚焦 →
代码仓库安全卫生
分支保护、Action pin、密钥卫生——你怎么管理仓库比代码本身更重要。
阅读聚焦 →
Reviewing repo code against web app risk patterns
Reviewing repo code against web app risk patterns
阅读聚焦 →