Hahwul Dalfox vulnerabilities

CVE-2026-45087 [CRITICAL] CWE-15 CVE-2026-45087: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is

CVE-2026-45089 [HIGH] CWE-73 CVE-2026-45089: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine's logg

CVE-2026-45088 [HIGH] CWE-73 CVE-2026-45088: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes

CVE-2026-45090 [HIGH] CWE-362 CVE-2026-45090: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, Par Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which