Skip to content
OpenAdvisories

Package · Go

github.com/BishopFox/joro

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.6
    CVE-2026-53649

    Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

    Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-dat…

    BishopFox joro github.com/BishopFox/joro Go