测试库
SafeVibe 的全部检查
此表直接由扫描器自身的规则生成，因此准确反映实际运行的内容。被动检查在每次扫描时运行；深度检查仅在已验证的网站上运行；仓库检查针对 GitHub 仓库。目录每小时自动增长。 了解它如何学习. 目录最近同步：2026-11-13。
1,304
检查总数
965
自动增长目录中的检查
83
被动网站检查
181
仓库检查
75
具名 CVE
2
被积极利用（KEV）
1304 项检查中的 1304 项
| 严重程度 | 检查项 | 范围 | 类别 | 技术 | CVE | 来源 |
|---|---|---|---|---|---|---|
| 高 | Grafana Snapshot - Authentication Bypass GET /api/snapshots/:key, /dashboard/snapshot/:key | 网站 · 深度 | Known CVEs & vulns | grafana | CVE-2021-39226KEV | nuclei-templates |
| 中 | Joomla! Webservice - Password Disclosure GET /api/index.php/v1/config/application?public=true, /api/v1/config/application?public=t… | 网站 · 深度 | Known CVEs & vulns | joomla | CVE-2023-23752KEV | nuclei-templates |
| 严重 | Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass GET /?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 | 网站 · 深度 | Known CVEs & vulns | wordpress | CVE-2026-18072 | nuclei-templates |
| 严重 | Apache APISIX Dashboard <2.10.1 - API Unauthorized Access GET /apisix/admin/migrate/export | 网站 · 深度 | Known CVEs & vulns | apache | CVE-2021-45232 | nuclei-templates |
| 严重 | Apache ShenYu Admin Unauth Access GET /plugin | 网站 · 深度 | Known CVEs & vulns | apache | CVE-2022-23944 | nuclei-templates |
| 严重 | baserCMS Installation - Exposure GET / | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | BlueImp jQuery-File-Upload - Arbitrary File Upload GET /jquery-file-upload/server/php/ | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | CirCarLife - Installer GET /html/setup.html | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | CISA Known Exploited Vulnerabilities Actively exploited CVEs escalated to critical | 实时情报 | Live feeds | generic | — | Live feed |
| 严重 | Committed .env file A .env file is committed to the repository. These hold production secrets and must never … | GitHub 仓库 | Sensitive files | generic | — | Built-in |
| 严重 | Committed credential store A git-credentials or kubeconfig file is committed. These hold plaintext tokens for your g… | GitHub 仓库 | Sensitive files | generic | — | Built-in |
| 严重 | Committed credentials JSON A credentials / service-account JSON file is committed. These usually grant broad cloud a… | GitHub 仓库 | Sensitive files | generic | — | Built-in |
| 严重 | Committed private SSH key A private SSH key is committed. Anyone with repo access can use it to impersonate you. | GitHub 仓库 | Sensitive files | generic | — | Built-in |
| 严重 | Compromised release: @ctrl/tinycolor@4.1.1, 4.1.2 Shai-Hulud npm worm (Sept 2025) — steals npm/GitHub/cloud tokens and republishes itself | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: @solana/web3.js@1.95.6, 1.95.7 Dec 2024 compromise — private-key exfiltration | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: ansi-regex@6.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: ansi-styles@6.2.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: backslash@0.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: chalk-template@1.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: chalk@5.6.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: coa@2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 Nov 2021 compromise — password stealer | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: color-convert@3.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: color-name@2.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: color-string@2.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: debug@4.4.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: error-ex@1.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, 10.1.7 July 2025 maintainer phishing (CVE-2025-54313) — Windows malware loader | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: event-stream@3.3.6 2018 flatmap-stream backdoor | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: has-ansi@6.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: is-arrayish@0.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: node-ipc@10.1.1, 10.1.2 Mar 2022 protestware — overwrites files | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: nx@20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 s1ngularity / Nx compromise (Aug 2025) — exfiltrated secrets via AI CLIs | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: rc@1.2.9, 1.3.9, 2.3.9 Nov 2021 compromise — password stealer | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: simple-swizzle@0.2.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: slice-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: strip-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: supports-color@10.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: supports-hyperlinks@4.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: ua-parser-js@0.7.29, 0.8.0, 1.0.0 Oct 2021 compromise — cryptominer & password stealer | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Compromised release: wrap-ansi@9.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub 仓库 | Supply chain | npm | — | Curated advisories |
| 严重 | Database error from crafted input (SQLi precondition) Single quote in a query parameter | 网站 · 深度 | Injection | generic | — | Built-in |
| 严重 | DigitalOcean Key Exposure via Axiom GET /.axiom/accounts/do.json | 网站 · 深度 | Exposed files | generic | — | nuclei-templates |
| 严重 | Docker Container - Misconfiguration Exposure GET /images/json | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=, /?alg_wc_ev_verify_emai… | 网站 · 深度 | Known CVEs & vulns | wordpress | — | nuclei-templates |
| 严重 | Exposed admin / tool: Actuator /env (full config leak) GET /actuator/env | 网站 · 深度 | Admin panels | generic | — | Built-in |
| 严重 | Exposed admin / tool: Actuator heap dump GET /actuator/heapdump | 网站 · 深度 | Admin panels | generic | — | Built-in |
| 严重 | Exposed secret: Anthropic API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: AWS Access Key ID Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: AWS Secret Access Key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Azure Storage connection string Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Database URL with embedded password Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: DigitalOcean token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: GitHub token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: GitLab personal access token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Google Cloud service-account key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Groq API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: HashiCorp Vault token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: npm access token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: npm auth token in .npmrc Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: OpenAI API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: OpenRouter API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Perplexity API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: PlanetScale credential Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Private Key Block Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: PyPI upload token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Replicate API token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Shopify access token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Stripe (or Clerk) live secret key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Supabase personal access token Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: Supabase secret key (sb_secret_) Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed secret: xAI (Grok) API key Regex on page + every JS bundle | 网站 · 被动 | Secrets | generic | — | Built-in |
| 严重 | Exposed: AWS credentials file GET /.aws/credentials | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Database backup dump GET /backup.sql | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Database dump GET /dump.sql | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Development environment file GET /.env.development | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Environment file (.env) GET /.env | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Environment file backup GET /.env.backup | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Git credential store GET /.git-credentials | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Local environment file GET /.env.local | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Production environment file GET /.env.production | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: SSH private key GET /id_rsa | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: Terraform state GET /terraform.tfstate | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Exposed: WordPress config backup GET /wp-config.php.bak | 网站 · 深度 | Exposed files | generic | — | Built-in |
| 严重 | Firebase Realtime Database world-readable GET /.json?shallow=true | 网站 · 深度 | Backend rules | firebase | — | Built-in |
| 严重 | Firebase rules allow public access allow … if true; / .read: true | GitHub 仓库 | Backend rules | firebase | — | Built-in |
| 严重 | Firestore collections readable without auth users, profiles, posts, messages, orders, chats | 网站 · 深度 | Backend rules | firebase | — | Built-in |
| 严重 | Fork CMS - Installer GET /install/2 | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | form-data < 2.5.4 / 3.0.4 / 4.0.4 Predictable multipart boundary allows parameter injection (CVE-2025-7783). | GitHub 仓库 | Dependencies | npm | — | Curated advisories |
| 严重 | GetSimple CMS - Installer GET /admin/install.php | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | GitHub Actions script injection Untrusted ${{ github.event.* }} in run/script | GitHub 仓库 | CI/CD | github-actions | — | Built-in |
| 严重 | GitLab CE/EE - Hard-Coded Credentials GET /users/sign_in | 网站 · 深度 | Known CVEs & vulns | gitlab | CVE-2022-1162 | nuclei-templates |
| 严重 | GitLab CE/EE - Information Disclosure GET /users/sign_in | 网站 · 深度 | Known CVEs & vulns | gitlab | CVE-2022-0735 | nuclei-templates |
| 严重 | Gogs (Go Git Service) - Installer GET /install | 网站 · 深度 | Misconfig & panels | generic | — | nuclei-templates |
| 严重 | Hardcoded secret: Anthropic API key Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: AWS Access Key ID Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: AWS Secret Access Key Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: Azure Storage connection string Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: Database URL with embedded password Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: DigitalOcean token Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
| 严重 | Hardcoded secret: GitHub token Regex on every text file (and git history) | GitHub 仓库 | Secrets | generic | — | Built-in |
设计即只读
每项检查都是一次 GET/HEAD 请求或一次模式匹配。会进行漏洞利用、模糊测试、暴力破解或发送载荷的模板在构建目录时即被拒绝。
一次生成，始终最新
每个来源模板只转换一次并记录在册。每小时同步只处理新增或变更内容，并更新积极利用标记。
来源
ProjectDiscovery nuclei-templates（MIT）、CISA KEV、OSV.dev、FIRST EPSS、OpenSSF 恶意包、精选安全公告，以及负责最新 CVE 的 SafeVibe AI 研究员。