Testbibliothek
Alle Prüfungen von SafeVibe
Diese Tabelle wird aus den Regeln des Scanners selbst erzeugt und zeigt genau, was ausgeführt wird. Passive Prüfungen laufen bei jedem Scan, tiefe nur auf verifizierten Websites, Repository-Prüfungen auf GitHub-Repositories. Der Katalog wächst stündlich von selbst. So lernt er. Letzte Katalog-Synchronisierung: 2026-11-13.
1.304
Prüfungen insgesamt
965
im selbst wachsenden Katalog
83
passive Website-Prüfungen
181
Repository-Prüfungen
75
benannte CVEs
2
aktiv ausgenutzt (KEV)
1304 von 1304 Prüfungen
| Schweregrad | Prüfung | Bereich | Kategorie | Technologie | CVE | Quelle |
|---|---|---|---|---|---|---|
| Hoch | Grafana Snapshot - Authentication Bypass GET /api/snapshots/:key, /dashboard/snapshot/:key | Website · tief | Known CVEs & vulns | grafana | CVE-2021-39226KEV | nuclei-templates |
| Mittel | Joomla! Webservice - Password Disclosure GET /api/index.php/v1/config/application?public=true, /api/v1/config/application?public=t… | Website · tief | Known CVEs & vulns | joomla | CVE-2023-23752KEV | nuclei-templates |
| Kritisch | Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass GET /?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 | Website · tief | Known CVEs & vulns | wordpress | CVE-2026-18072 | nuclei-templates |
| Kritisch | Apache APISIX Dashboard <2.10.1 - API Unauthorized Access GET /apisix/admin/migrate/export | Website · tief | Known CVEs & vulns | apache | CVE-2021-45232 | nuclei-templates |
| Kritisch | Apache ShenYu Admin Unauth Access GET /plugin | Website · tief | Known CVEs & vulns | apache | CVE-2022-23944 | nuclei-templates |
| Kritisch | baserCMS Installation - Exposure GET / | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | BlueImp jQuery-File-Upload - Arbitrary File Upload GET /jquery-file-upload/server/php/ | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | CirCarLife - Installer GET /html/setup.html | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | CISA Known Exploited Vulnerabilities Actively exploited CVEs escalated to critical | Live-Daten | Live feeds | generic | — | Live feed |
| Kritisch | Committed .env file A .env file is committed to the repository. These hold production secrets and must never … | GitHub-Repository | Sensitive files | generic | — | Built-in |
| Kritisch | Committed credential store A git-credentials or kubeconfig file is committed. These hold plaintext tokens for your g… | GitHub-Repository | Sensitive files | generic | — | Built-in |
| Kritisch | Committed credentials JSON A credentials / service-account JSON file is committed. These usually grant broad cloud a… | GitHub-Repository | Sensitive files | generic | — | Built-in |
| Kritisch | Committed private SSH key A private SSH key is committed. Anyone with repo access can use it to impersonate you. | GitHub-Repository | Sensitive files | generic | — | Built-in |
| Kritisch | Compromised release: @ctrl/tinycolor@4.1.1, 4.1.2 Shai-Hulud npm worm (Sept 2025) — steals npm/GitHub/cloud tokens and republishes itself | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: @solana/web3.js@1.95.6, 1.95.7 Dec 2024 compromise — private-key exfiltration | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: ansi-regex@6.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: ansi-styles@6.2.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: backslash@0.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: chalk-template@1.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: chalk@5.6.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: coa@2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 Nov 2021 compromise — password stealer | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: color-convert@3.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: color-name@2.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: color-string@2.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: debug@4.4.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: error-ex@1.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, 10.1.7 July 2025 maintainer phishing (CVE-2025-54313) — Windows malware loader | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: event-stream@3.3.6 2018 flatmap-stream backdoor | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: has-ansi@6.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: is-arrayish@0.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: node-ipc@10.1.1, 10.1.2 Mar 2022 protestware — overwrites files | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: nx@20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 s1ngularity / Nx compromise (Aug 2025) — exfiltrated secrets via AI CLIs | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: rc@1.2.9, 1.3.9, 2.3.9 Nov 2021 compromise — password stealer | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: simple-swizzle@0.2.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: slice-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: strip-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: supports-color@10.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: supports-hyperlinks@4.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: ua-parser-js@0.7.29, 0.8.0, 1.0.0 Oct 2021 compromise — cryptominer & password stealer | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Compromised release: wrap-ansi@9.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub-Repository | Supply chain | npm | — | Curated advisories |
| Kritisch | Database error from crafted input (SQLi precondition) Single quote in a query parameter | Website · tief | Injection | generic | — | Built-in |
| Kritisch | DigitalOcean Key Exposure via Axiom GET /.axiom/accounts/do.json | Website · tief | Exposed files | generic | — | nuclei-templates |
| Kritisch | Docker Container - Misconfiguration Exposure GET /images/json | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=, /?alg_wc_ev_verify_emai… | Website · tief | Known CVEs & vulns | wordpress | — | nuclei-templates |
| Kritisch | Exposed admin / tool: Actuator /env (full config leak) GET /actuator/env | Website · tief | Admin panels | generic | — | Built-in |
| Kritisch | Exposed admin / tool: Actuator heap dump GET /actuator/heapdump | Website · tief | Admin panels | generic | — | Built-in |
| Kritisch | Exposed secret: Anthropic API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: AWS Access Key ID Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: AWS Secret Access Key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Azure Storage connection string Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Database URL with embedded password Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: DigitalOcean token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: GitHub token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: GitLab personal access token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Google Cloud service-account key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Groq API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: HashiCorp Vault token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: npm access token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: npm auth token in .npmrc Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: OpenAI API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: OpenRouter API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Perplexity API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: PlanetScale credential Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Private Key Block Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: PyPI upload token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Replicate API token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Shopify access token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Stripe (or Clerk) live secret key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Supabase personal access token Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: Supabase secret key (sb_secret_) Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed secret: xAI (Grok) API key Regex on page + every JS bundle | Website · passiv | Secrets | generic | — | Built-in |
| Kritisch | Exposed: AWS credentials file GET /.aws/credentials | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Database backup dump GET /backup.sql | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Database dump GET /dump.sql | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Development environment file GET /.env.development | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Environment file (.env) GET /.env | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Environment file backup GET /.env.backup | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Git credential store GET /.git-credentials | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Local environment file GET /.env.local | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Production environment file GET /.env.production | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: SSH private key GET /id_rsa | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: Terraform state GET /terraform.tfstate | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Exposed: WordPress config backup GET /wp-config.php.bak | Website · tief | Exposed files | generic | — | Built-in |
| Kritisch | Firebase Realtime Database world-readable GET /.json?shallow=true | Website · tief | Backend rules | firebase | — | Built-in |
| Kritisch | Firebase rules allow public access allow … if true; / .read: true | GitHub-Repository | Backend rules | firebase | — | Built-in |
| Kritisch | Firestore collections readable without auth users, profiles, posts, messages, orders, chats | Website · tief | Backend rules | firebase | — | Built-in |
| Kritisch | Fork CMS - Installer GET /install/2 | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | form-data < 2.5.4 / 3.0.4 / 4.0.4 Predictable multipart boundary allows parameter injection (CVE-2025-7783). | GitHub-Repository | Dependencies | npm | — | Curated advisories |
| Kritisch | GetSimple CMS - Installer GET /admin/install.php | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | GitHub Actions script injection Untrusted ${{ github.event.* }} in run/script | GitHub-Repository | CI/CD | github-actions | — | Built-in |
| Kritisch | GitLab CE/EE - Hard-Coded Credentials GET /users/sign_in | Website · tief | Known CVEs & vulns | gitlab | CVE-2022-1162 | nuclei-templates |
| Kritisch | GitLab CE/EE - Information Disclosure GET /users/sign_in | Website · tief | Known CVEs & vulns | gitlab | CVE-2022-0735 | nuclei-templates |
| Kritisch | Gogs (Go Git Service) - Installer GET /install | Website · tief | Misconfig & panels | generic | — | nuclei-templates |
| Kritisch | Hardcoded secret: Anthropic API key Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: AWS Access Key ID Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: AWS Secret Access Key Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: Azure Storage connection string Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: Database URL with embedded password Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: DigitalOcean token Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
| Kritisch | Hardcoded secret: GitHub token Regex on every text file (and git history) | GitHub-Repository | Secrets | generic | — | Built-in |
Schreibgeschützt by Design
Jede Prüfung ist eine einzelne GET/HEAD-Anfrage oder eine Mustersuche. Vorlagen, die ausnutzen, fuzzen, Brute Force betreiben oder Nutzlasten senden, werden beim Katalogaufbau abgelehnt.
Einmal erzeugt, immer aktuell
Jede Quellvorlage wird genau einmal umgewandelt und registriert. Stündliche Synchronisierungen verarbeiten nur Neues oder Geändertes und aktualisieren die Markierungen für aktive Ausnutzung.
Quellen
ProjectDiscovery nuclei-templates (MIT), CISA KEV, OSV.dev, FIRST EPSS, bösartige Pakete von OpenSSF, kuratierte Hinweise und der KI-Forscher von SafeVibe für die neuesten CVEs.