138224 matches found
CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-87862
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
CVE-2021-41773-L-
CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...
libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
Important: Red Hat Security Advisory: libsoup3 security update
An update for libsoup3 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
CVE-2025-31650
Apache Tomcat 10.1.39 - Denial of Service DoS This tool performs a high-volume, asynchronous HTTP/2 request flood using malformed priority headers to test the stability of Apache Tomcat servers running version 10.1.10 to 10.1.39. ⚠️ This is strictly for educational and research purposes only. ❌ Th...
cve-2023-44487
CVE-2023-44487 HTTP/2 Rapid Reset There are some examples in this repo which are not tested completely to analyse the impact, but I just wanted to perform the concept of this attack starting many streams and immediately sending RSTSTREAM frame to avoid reaching MAXCONCURRENTSTREAMS. H2SpaceX I us...
cve-2021-42013-httpd
Dockerisation of a Vulnerability: cve-2021-42013 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Apache HTTP Server 2.4.50 - Remote Code...
CVE-2025-55182-VulnCheckPOC
CVE-2025-55182 Vulnerability Check PoC Proof-of-concept scanner for detecting React Server Components RSC vulnerability in Next.js applications CVE-2025-55182. Usage This is only a check to see if a server is vulnerable, based on this release by Searchlight Cyber...
CVE-2021-41773
CVE-2021-41773 — Apache Path Traversal & RCE Exploitation Writeup of the TryHackMe "Modern Web Stacks" room, focused on exploiting CVE-2021-41773 , a path traversal vulnerability in Apache HTTP Server 2.4.49 that leads to remote code execution when modcgi is enabled. Summary Item| Detail ---|---...
struts-rce
:source-highlighter: pygments = Apache Struts CVE-2017-5638 exploitation This simple web application is built with vulnerable Apache Struts 2.5.10 CVE-2017-5638. It's vulnerable to RCE. == Starting web application To start vulnerable web application, execute: mvn jetty:run The application will be...
CVE-2022-26134
pip3 install -r requirements.txt use: python3 exp.py url "cmd" example: python3 exp.py http://192.168.1.1/ whoami...
CVE-2026-107718
A flaw was found in AdonisJS HTTP Server. The route URL generation helper fails to properly encode parameter values when constructing redirect destinations. A remote attacker can exploit this flaw by supplying a crafted path parameter starting with a forward slash, generating a scheme-relative...
jsfinder
Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...
CVE-2024-55374
CVE-2024-55374 Redcap 14.3.13 is vulnerable to user enumeration because it returns distinct error messages depending on whether the user exists or not. This allows an attacker to send multiple HTTP authentication requests to perform brute-force attacks. Although a protection mechanism exists to...
weevely3
Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...
CLEANSTART-2026-FF99068 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server...
CLEANSTART-2026-DQ31365 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server)
CVE-2022-21628 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server. See references for individual vulnerability details...