Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2026-34847 PoC — hoppscotch: Open redirect via `/enter?redirect=`

Source
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/appsmith/appsmith-info-disclosure.yaml
Associated Vulnerability
Title:hoppscotch: Open redirect via `/enter?redirect=` (CVE-2026-34847)
Description:hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0.
Description
Appsmith <= v1.97 instance management API endpoints are accessible without authentication, allowing an attacker to obtain sensitive information such as license plan, instance ID, authentication providers, feature flags, and configuration metadata via unauthenticated requests to specific API endpoints.
File Snapshot

 id: appsmith-info-disclosure

info:
  name: Appsmith <= v1.97 - Information Disclosure
  author: rit

...
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →