CVE-2021-36798

CVE-2021-36798 CVE-2021-36798 Cobalt Strike 4.3 DoS Usage python3 CVE-2021-36798.py BeaconURL Cripple Cobalt Strike with just one packet Tested on 4.3, 4.2 References: https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations/...

EUVD-2026-90850

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103687 rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-63441

CVE-2025-63441 Title: Reflected XSS via arbitrarily supplied URL parameter param at endpoint u/administrator/friends Summary: A Reflected Cross-Site Scripting XSS vulnerability was identified in the u/administrator/friends endpoint of the OSSN application. This vulnerability allows attackers to...

cve-2025-24514

🔥 CVE-2025-24514 Remote Vulnerability Check PoC This script is a Python-based PoC that can remotely check for the CVE-2025-24514 vulnerability NGINX configuration manipulation and potential RCE through auth-url injection in ingress-nginx. 🧠 Vulnerability Overview CVE-2025-24514 is a vulnerability...

CVE-2021-43798-EXPLOIT

CVE-2021-43798 - Grafana Directory Traversal 🔍 Grafana is an open-source platform for monitoring and observability. Versions 8.0.0-beta1 through 8.3.0 except for patched versions are vulnerable to a directory traversal attack, allowing unauthorized access to local files. This vulnerability does n...

CVE-2022-25765-exploit

CVE-2022-25765 — Command Injection in pdfkit Descripción CVE-2022-25765 es una vulnerabilidad de inyección de comandos Command Injection que afecta a pdfkit Ruby gem en versiones 0.8.7.2. La vulnerabilidad tiene una severidad CRÍTICA con CVSS 9.8, ya que permite ejecución remota de comandos sin...

Solr-SSRF

Solr-SSRF Apache Solr SSRF Uso - Vulnerabilidad Apache Solr SSRF CVE-2021-27905 - Opciones: -h or --help : Descripción del método -u or --url : URL del sitio -d or --dnslog : DnsLog ej. python3 CVE-2021-27905.py -u URL -d dnslog...

Metabase-cve-2021-41277

Metabase-cve-2021-41277 Metabase arbitrary file read optional arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use eg1:python3 Metabase-cve-2021-41277.py -u http://127.0.0.1 eg2:python3...

CVE-2014-0094-test-program-for-struts1

Correspondencia de CVE-2014-0094 con struts1 Introducción Este documento resume el impacto de CVE-2014-0094 en struts1. A menos que se indique lo contrario, cada versión fue verificada con java 1.7.002, struts 1.3.10, apache-tomcat-6.0.39, FreeBSD 8.2. Además, bajo ninguna circunstancia se...

CVE-2025-33053-Proof-Of-Concept

CVE-2025-33053 Proof Of Concept This repository provides scripts to automatically deploy a WebDAV server on Ubuntu using Apache2 , and generate malicious.url shortcut files for use in phishing, red teaming, or lateral movement simulation. 📁 Contents setupwebdav.sh – Bash script to configure Apach...

cve-2017-0065

Exploiting Edge's read:// urlhandler Introduction This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for...

next_js_poisoning

CVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These...

CVE-2021-41773

CVE-2021-41773 Fast python tool to test apache path traversal CVE-2021-41773 in a List of url Usage :- create a live urls file and use the flag "-l" python3 apachepathtraversal.py -l urls-list.txt...

CVE-2021-42013-EXPLOIT

🚨 CVE-2021-42013 - Apache 2.4.49 & 2.4.50 Remote Code Execution 🚨 CVE-2021-42013 builds upon the previously identified vulnerability, CVE-2021-41773. Despite the Apache team's efforts to address CVE-2021-41773 in version 2.4.50, subsequent investigations revealed that the fix fell short of fully...

EUVD-2026-90847

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686

The rhukster dom-sanitizer library (up to version 1.0.15 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the URL Validation component. Specifically, the DOMSanitizer::isDangerousUrl function in src/DOMSanitizer.php can be manipulated to allow malicious scripts. This vulnerability c...

HeartBleed-Vulnerability-Checker

Verificador de Vulnerabilidad Heartbleed author = 'WaQas-JaMal' Demostración rápida y sencilla de CVE-2014-0160 por Jared Stafford [email protected] y el autor renuncia a los derechos de autor de este código fuente. ''' He modificado este script para que tome cualquier archivo de URL de...