Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      Microsoft Graph CLI to be retired

      September 2, 2025

      The state of DevOps and AI: Not just hype

      September 1, 2025

      A Breeze Of Inspiration In September (2025 Wallpapers Edition)

      August 31, 2025

      10 Top Generative AI Development Companies for Enterprise Node.js Projects

      August 30, 2025

      I asked AI to modify mission-critical code, and what happened next haunts me

      September 3, 2025

      Why you should delete your browser extensions right now – or do this to stay safe

      September 3, 2025

      Dolby Vision 2 comes with big upgrades – here’s which TVs get them first

      September 3, 2025

      This one small feature makes this travel charger my favorite for business trips

      September 3, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Laracon AU 2025 Talk Titles Revealed

      September 3, 2025
      Recent

      Laracon AU 2025 Talk Titles Revealed

      September 3, 2025

      Stop Writing Bad Controllers: Laravel Custom Collections Transform Your Code

      September 3, 2025

      Handle ownership relationships between Eloquent models with Laravel Ownable

      September 3, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Lenovo Legion Go 2 confirmed with Ryzen Z2 Extreme, 1200p OLED 144Hz display & 74Wh battery

      September 2, 2025
      Recent

      Lenovo Legion Go 2 confirmed with Ryzen Z2 Extreme, 1200p OLED 144Hz display & 74Wh battery

      September 2, 2025

      How to Open Ports in Firewall on Windows Server

      September 2, 2025

      Google TV Remote Not Working? 5 Quick Fixes

      September 2, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»Security»Common Vulnerabilities and Exposures (CVEs)»CVE-2025-53889 – Directus Unauthenticated Flow Trigger Vulnerability

    CVE-2025-53889 – Directus Unauthenticated Flow Trigger Vulnerability

    July 15, 2025

    CVE ID : CVE-2025-53889

    Published : July 15, 2025, 12:15 a.m. | 2 hours, 36 minutes ago

    Description : Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker’s behalf without authenticating. Bad actors could execute the manual trigger Flows without authentication, or access rights to the said collection(s) or item(s). Users with manual trigger Flows configured are impacted as these endpoints do not currently validate if the user has read access to `directus_flows` or to the relevant collection/items. The manual trigger Flows should have tighter security requirements as compared to webhook Flows where users are expected to perform do their own checks. Version 11.9.0 fixes the issue. As a workaround, implement permission checks for read access to Flows and read access to relevant collection/items.

    Severity: 6.5 | MEDIUM

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Source: Read More

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleCVE-2025-53885 – Directus Console Log Data Exposure Vulnerability
    Next Article CVE-2025-53887 – Directus OpenAPI Spec Version Disclosure

    Related Posts

    Development

    Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets

    September 3, 2025
    Development

    Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware

    September 3, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    CVE-2025-4456 – Project Worlds Car Rental Project SQL Injection Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-23267 – NVIDIA Container Toolkit Link Following Vulnerability (Denial of Service and Data Tampering)

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-4087 – “Firefox XPath Parsing Memory Corruption Vulnerability”

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-5023 – Mitsubishi Electric Corporation EcoGuideTAB Photovoltaic System Monitor Hard-coded Credentials Backdoor

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    Development

    Automating REST APIs with Selenium and Postman

    June 19, 2025

     
    API testing has become an integral part of software quality assurance. Automating REST APIs ensures the robustness and reliability of web applications by validating backend functionality. In this blog, we will explore how Selenium and Postman can be used to automate REST APIs, providing both flexibility and scalability in your testing processes.

    Why Automate REST APIs?
    Automating REST APIs brings several benefits, including:

    Speed: Automated tests execute faster compared to manual testing.

    Accuracy: Minimizes human error in repetitive tasks.

    Efficiency: Allows simultaneous testing of multiple endpoints.

    Integration: Fits seamlessly into CI/CD pipelines.

    Key Concepts in REST API Automation
    Before diving into automation, let’s understand some key concepts:

    API Endpoint: A URL that specifies where an API resource is located.

    HTTP Methods: Common methods include GET, POST, PUT, DELETE.

    Status Codes: Responses like 200 (OK), 404 (Not Found), 500 (Server Error).

    Request Payload: The data sent with a request, often in JSON format.

    Response: Data received from the server, including status and body.

    Tools Overview: Selenium and Postman

    Selenium: Best suited for UI testing but can complement API testing by validating front-end integration with APIs.

    Postman: A powerful API testing tool that supports request creation, test scripting, and automation through Newman CLI.

    Practical Applications of API Testing

    Authentication: Validating login and token-based authentication mechanisms.

    Data Integrity: Ensuring the correctness of data returned by APIs.

    Error Handling: Checking proper error messages and status codes.

    Load Testing: Simulating multiple users accessing APIs simultaneously.

    Setting Up Selenium and Postman for API Automation
    1. Installing Selenium
    Ensure you have Java and Maven installed. Add Selenium dependencies to your pom.xml:<dependency>
    <groupId>org.seleniumhq.selenium</groupId>
    <artifactId>selenium-java</artifactId>
    <version>4.10.0</version>
    </dependency>2. Installing Postman
    Download Postman from Postman’s official website. For automation, install Newman:
    npm install -g newman

    Coding Examples: Automating REST APIs with Selenium and Postman
    Example 1: Sending API Requests Using Java (RestAssured Library)import io.restassured.RestAssured;
    import io.restassured.response.Response;

    public class ApiTest {
    public static void main(String[] args) {
    RestAssured.baseURI = “https://jsonplaceholder.typicode.com”;

    // GET Request
    Response response = RestAssured.given().get(“/posts/1”);
    System.out.println(“Status Code: ” + response.getStatusCode());
    System.out.println(“Response Body: ” + response.getBody().asString());

    // Assert Status Code
    assert response.getStatusCode() == 200;
    }
    }
    Example 2: Running Postman Collections via Newman

    Export your Postman collection as a JSON file.

    Use Newman CLI to execute the collection:newman run my-collection.json
    Example 3: Integrating Selenium with API Responses
    This example demonstrates how to combine API testing with UI testing by validating that the data returned from an API call is correctly displayed on a web application’s UI. Here’s a breakdown of the code:import org.openqa.selenium.By;
    import org.openqa.selenium.WebDriver;
    import org.openqa.selenium.WebElement;
    import org.openqa.selenium.chrome.ChromeDriver;
    import io.restassured.RestAssured;

    public class SeleniumApiIntegration {
    public static void main(String[] args) {
    // API Call
    RestAssured.baseURI = “https://api.example.com”;
    String apiData = RestAssured.given().get(“/data”).getBody().asString();

    // Selenium Test
    WebDriver driver = new ChromeDriver();
    driver.get(“https://example.com”);

    WebElement element = driver.findElement(By.id(“apiDataField”));
    assert element.getText().equals(apiData);

    driver.quit();
    }
    }

    1. API Call with RestAssured
    The first step involves using RestAssured to interact with the API. A base URL is set, and a GET request is sent to a specific endpoint. The response body is retrieved as a string, which will later be compared with the data displayed on the web page.

    2. Selenium Test
    The Selenium WebDriver is initialized to open the browser and navigate to the target URL. This ensures that the web page containing the UI element to be validated is loaded and ready for interaction.

    3. Finding the Web Element
    A specific element on the web page is located using a unique identifier (like an ID attribute). This UI element is expected to display the same data that was fetched from the API.

    4. Validating the Data
    The text content of the located UI element is retrieved and compared with the API response. If the values match, the test passes, indicating consistency between the API and UI. If they don’t match, it signals a potential bug or data discrepancy.

    5. Closing the Browser
    Finally, the browser session is terminated to ensure no resources are left open after the test execution.

    Use Case
    This approach is used to verify the consistency of data between the backend (API response) and the frontend (UI). For example:

    Validating that product details provided by an API, such as name or price, are displayed accurately on a webpage.

    Benefits

    End-to-End Testing: Ensures seamless integration between the backend and frontend.

    Early Bug Detection: Detects mismatches between API and UI during testing phases.

    Reusable: Can be extended to validate multiple API endpoints and corresponding UI elements.
    Step-by-Step Guide to Automate API Testing

    Understand API Requirements: Review API documentation to understand endpoints, methods, and payloads.

    Create Test Cases: Identify scenarios such as response validation, status codes, and data formats.

    Use Postman for Initial Testing: Verify API responses manually.

    Automate with Java: Use RestAssured or HttpClient libraries for scripting.

    Integrate with Selenium: Combine API data validation with UI testing.

    Leverage CI/CD: Incorporate automated tests into Jenkins or GitHub Actions.

    Conclusion
    By integrating Selenium and Postman, you can create a comprehensive automation suite that tests APIs and ensures seamless integration between backend and frontend systems. API testing not only improves the reliability of web applications but also accelerates the development cycle, allowing teams to deliver high-quality products efficiently.

    CTA: Have questions about API testing with Selenium and Postman? Share them in the comments below!

    7 Best Free and Open Source Zsh Configuration Frameworks

    August 29, 2025

    CVE-2009-20002 – Millenium MP3 Studio Stack-Based Buffer Overflow

    August 21, 2025

    CVE-2025-46249 – Elementor Simple Calendar CSRF

    April 22, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.