Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. id: CVE-2019-10098 info: name: Apache HTTP server v2.4.0 to v2.4.39 - Open...

Apache HTTP Server - Remote Code Execution

Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in modproxyuwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests. id: CVE-2020-1198...

CVE-2021-41773

ApacheRCE ApacheRCE is a small little python script that will allow you to input the apache version 2.4.49-2.4.50 and then input a list of ip addresses from a text file and mass run the exploit on them, this can be useful if you are running mutiple websites and you want to see if they can all be...

CVE-2021-41773-POC

CVE-2021-41773-POC The POC and Lab setup documentation of CVE 2021 41773 What is CVE-2021-41773? CVE-2021-41773 is a path traversal vulnerability in Apache HTTP server 2.4.49 and 2.4.50. This vulnerability exploits an update in the path normalisation code introduced in this version. The Path...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contributors 이희수@lheeeesoo Apache HTTP Server 2.4.49 has a vulnerability where it fails to properly block encoded parent paths during URL path normalization. An attacker can use values like .%2e to traverse outside the directories that the web serv...

LayarKacaSiber-CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 How to Run the CVE-2021-41773-Path Traversal Lab 1. Install and run Docker on your PC/Laptop 2. Clone this GitHub repo 3. Go to the Path Traversal folder 4. Run the following commands docker build -t cve-2021-41773-path-traversal . and docker run --rm -d...

cve-2022-31813

CVE-2022-31813 Vulnerability Checker Author : Derek Odiorne GitHub : @dodiorne Version : 1.2 Last Updated : May 21, 2025 MITRE ATT &CK Technique: T1190 – Exploit Public-Facing Application 🧠 Description This tool is a black-box vulnerability scanner for detecting CVE-2022-31813 , a path traversal...

CVE-2024-40275_Scanner

CVE-2024-40725 Scanner A Python-based detection tool for CVE-2024-40725 , an Apache HTTP Server source code disclosure vulnerability affecting versions 2.4.0 and 2.4.61. Legal notice: Only run this scanner against servers you own or have explicit written authorization to test. Unauthorized use ma...

CVE-2026-23918

CVE-2026-23918: Apache HTTP/2 Double-Free DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67 A double-free vulnerability in modhttp2 h2mplx.c allows remote attackers to cause a denial of service worker crash via rapid RSTSTREAM frames that trigger a...

CVE-2024-38473

Proof of Concept PoC for Encoding Problem in modproxy in Apache HTTP Server This repository contains Proof of Concept PoC scripts for demonstrating an encoding problem in the modproxy module of Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allows request URLs with incorrect...

cve-2021-41773-source-code-analysis

Apache HTTP Server CVE-2021-41773 Source Code Analysis A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 Apache HTTP Server Path Traversal by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation...

CVE-2026-63292

⚠️ CVE-2026-63292 — Apache HTTP Server Security Vulnerability 🔐 --- 🔎 Overview CVE-2026-63292 is a stack-based buffer overflow vulnerability affecting the Apache HTTP Server modvhostalias module. The issue can be triggered under specific server configurations involving oversized HTTP Host headers...

CVE-2021-40438

CVE-2021-40438 Apache forward request CVE CVE-2021-40438: A crafted request uri-path can cause modproxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. This CVE could be used to spoof the original IPs in DoS attacks...

CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

CTF_WRITEUPS-TryHackMe-CVE-2021-41773-

CTFWRITEUPS-TryHackMe-CVE-2021-41773- CTFWRITEUPS/TryHackMe /CVE-2021-41773/ CVE-2021-41773/42013 A small explanation of an Apache path traversal bug and an incomplete fix Task 1: A Bit of Background... A Brief History On the 5th of October 2021, a CVE detailing a path traversal attack on Apache...

mass_cve-2021-41773

masscve-2021-41773 MASS CVE-2021-41773 Screenshot Usage ! python3 -m pip install requests pyyhon3 cve-2021-41773.py urlist.txt pool Note ! results will be automatically saved in vuln.txt u can add a common dir on...

-CVE-2021-44790

CVE-2021-44790 Description of CVE-2021-44790 CVE-2021-44790 describes a system-level security vulnerability in the modlua of the Apache HTTP Server, specifically in version 2.4.51 and earlier versions. This vulnerability is triggered when the r:parsebody function improperly handles HTTP...

CVE-2021-41773

CVE-2021-41773 A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013 References https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-41773 https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-42013...

CVE-2021-40438-Apache-2.4.48-SSRF-exploit

CVE-2021-40438 - Apache = 2.4.48 - SSRF Python exploit A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. CVSS v3.1: Base Score: 9.0 Severity: CRITICAL...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done root:x:0:0:root:/root:/bin/bash...