h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

Forbidden-Buster

Forbidden Buster is a tool designed to automate various techniques in order to bypass HTTP 401 and 403 response codes and gain access to unauthorized areas in the system. This code is made for security enthusiasts and professionals only. Use it at your own risk. Features Probes HTTP 401 and 403...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling For educational purposes only Setup $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirm /admin is denied. $ curl...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...

cve-2022-31813

CVE-2022-31813 Vulnerability Checker Author : Derek Odiorne GitHub : @dodiorne Version : 1.2 Last Updated : May 21, 2025 MITRE ATT &CK Technique: T1190 – Exploit Public-Facing Application 🧠 Description This tool is a black-box vulnerability scanner for detecting CVE-2022-31813 , a path traversal...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

LolLMS <= 2.2.0 - Unauthenticated File Upload

A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Dependsgetcurrentactiveuser dependency used by other file-related APIs. id: CVE-2026-0558 info: name:...

Symfony HttpFoundation - Access Control Bypass via PATH_INFO

Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...

N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 id: CVE-2026-86206 info: name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing author:...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

CVE-2026-93895

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods...

CVE-2023-25690

CVE-2023-25690 Description of CVE-2023-25690: Some modproxy configurations on Apache HTTP Server from version 2.4.0 to 2.4.55 allow HTTP Request Smuggling attacks a technique that interferes with the way a website processes HTTP request sequences received from one or more users. These...

CVE-2026-93895

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to an Improper Access Control flaw (CWE-284 ). When the grpc-1.0 feature is enabled, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods . This vulnerability...

CVE-2024-48208

CVE-2024-48208 The repo contains all the work surrounding the development of the PoC for how a simple OOBOut-of-bound read can result in jail escapes as well as broken access control. About the Vulnerability The orginial CVE Description is as follows: The Github PR on the official repo details ou...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023–23752 This readme file provides information about the Joomla Unauthorized Access Vulnerability CVE-2023–23752 and how to detect. This vulnerability allows an attacker to bypass the Joomla access control system and gain unauthorized...

nextjs-middleware-bypass-demo

CVE-2025-29927 Demo Original writeup: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Setup First, run the development server: npm i npm run dev Open http://localhost:3000 with your browser to see the result. Trying out the bypass curl -I http://localhost:300...

CVE-2026-90132

A flaw was found in the Linux kernel's NTFS filesystem. This vulnerability allows an unprivileged local user to bypass intended access controls by modifying reserved extended attributes xattrs, such as $LXUID, $LXGID, $LXMOD, and $LXDEV, through the setxattr function. This unauthorized modificati...

splitting-the-email-atom

Splitting The Email Atom: Exploiting Parsers To Bypass Access Controls Welcome to the repo. This repository contains all the materials for my talk "Splitting The Email Atom:Exploiting Parsers To Bypass Access Controls". You can read about this research at:...

PT-2026-113391

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods...