CVE-2022-29337

CVE-2022-29337 C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

PoC-CVE-2000-0649

PoC-CVE-2000-0649 A small tool to create a PoC for CVE-2000-0649. Usage This script verifies if the server is vulnerable for CVE-2000-0649. Keep in mind to play with HTTP, HTTPS and different paths. In my experience, the disclosure is mostly happening when connecting over HTTP and using the defau...

apache-cve-2021-42013-rce

apache-cve-2021-42013-rce Docker-based penetration testing lab simulating CVE-2021-42013 vulnerability Path Traversal & RCE on Apache HTTP Server 2.4.49. This project is prepared to simulate and exploit the CVE-2021-42013 vulnerability found in Apache HTTP Server 2.4.49 in an isolated environment...

CVE-2021-41773

CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49-2.4.50. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these...

EUVD-2026-103386

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schemaname leads to missing...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Burst Statistics Authentication Bypass -brightgreen.svg?style=for-the-badge !CAUTION CRITICAL ALERT: This vulnerability allows an unauthenticated remote attacker to bypass authentication and gain full Administrator privileges on the target WordPress site by simply injecting a...

CVE-2020-14882

CVE-2020-14882 This Python script is designed to exploit a Remote Code Execution vulnerability in Oracle WebLogic Server CVE-2020-14882 to execute commands on a vulnerable target server and capture their output through HTTP requests. It first prompts for a target WebLogic URL and network interfac...

CVE-2025-0108-Authentication-Bypass-checker

This tool tests whether a target PAN-OS device is vulnerable to the CVE-2025-0108 authentication bypass vulnerability . It sends a crafted HTTP request to the target and analyzes the response to determine if the device is exploitable. Usage single ip python authbypasscve20250108.py -u...

CVE-2004-2271-MiniShare-1.4.1-BOF

CVE-2004-2271 - MiniShare 1.4.1 - BOF References https://nvd.nist.gov/vuln/detail/CVE-2004-2271 Vulnerability MiniShare 1.4.1 has no bounds checking on HTTP GET requests it receives. By sending a long, malformed HTTP GET request, an attacker can perform a buffer overflow and execute arbitrary cod...

CVE-2024-40324

CVE-2024-40324 Description A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Vulnerability Type CRLF Vendor of Product E-Staff Affected Product Cod...

cve-2022-21907

CVE-2022-21907 This package will detect exploits of CVE-2022-21907 https://corelight.com/blog/detecting-cve-2022-21907 Detection Method: HTTP HTTP data must be = 1750 bytes, and The HTTP/1.1 is not observed at the end of the exploit HTTP request. Usage: $ zeek -Cr your.pcap packages $ cat...

CVE-2016-3088

CVE-2016-3088 Apache ActiveMQ Remote Code Execution Exploit Description The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Author Alexandre Aguiar @cyberaguiar Exploit...

Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Apache Pluto 3.0.0 issue in the authorisation logic which lets attacker upload malicious files by tampering HTTP methods. Script written in python3. Usage: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

gxdlmsdirector-cve

Multiple vulnerabilities in Gurux GXDLMS Director – remote code execution Gurux GXDLMS Director is an open-source Windows program for interacting with energy meters through the use of DLMS/COSEM protocol. The software has a remote update functionality for add-in DLLs as well as for files containi...

CVE-2025-24813-POC

JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...

PT-2026-116610

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL EXPORTER OTLP CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or...

async-http-client-check

async-http-client-check Offline checker for the 26 repository-level security advisories oforg.asynchttpclient:async-http-client AsyncHttpClient, "AHC". It tells you which ones your jar is actually exposed to, flags the ones Dependabot and OSV cannot see , and gives one answer per line: 3.x →3.0.1...

CVE-2021-41773

CVE-2021-41773 PoC — Apache HTTP Server Path Traversal Overview CVE-2021-41773 is a path traversal vulnerability affecting Apache HTTP Server 2.4.49. The vulnerability allows an attacker to access files outside the intended directory under specific configurations, particularly when directories ar...

Fake_CVE-2020-1350

FakeCVE-2020-1350 This is the source code for a very crude fake CVE-2020-1350 exploit tool, which developed as part of honeypot repository for the SIGRed vulnerability, with the goal of tracking/mapping interest and attempts to use exploits for this critical vulnerability. This project was...

CVE-2026-86350

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-86350 CVE-2026-86350 Apache Tomcat 9.0.121 - Apache Software Foundation I am @abraxasnull. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py. HTTP/2 header mix-up. A regression in the CVE-2026-41293...