Hahwul vulnerabilities
We track 4 vulnerabilities in Hahwul products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 27, 2026.
Latest Hahwul vulnerabilities
- 7.5 High severity
dalfox: Concurrent Execution using Shared Resource with Improper Synchronization
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly clos
- 8.2 High severity
dalfox: External Control of File Name or Path
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's
- 7.5 High severity
dalfox: External Control of File Name or Path
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request bod
- 10.0 Critical severity
dalfox: External Control of System or Configuration Setting
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly