Sercomm VD625 Smart Modems - CRLF Injection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. id: CVE-2021-27132 info: name: Sercomm VD625 Smart Modems - CRLF Injection author: geeknik severity: critical description: Sercomm...

Monstra CMS 3.0.4 - HTTP Header Injection

Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...

Airachnid-Burp-Extension

Web Cache Deception Burp Extension A Burp extension to test applications for vulnerability to the Web Cache Deception attack. Once the extension has been loaded, it can be accessed in the Target - Sitemap tab and right click on the resource that should be tested. A context sensitive menu item...

CVE-2023-6063

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

CVE-2026-104032

A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of...

CVE-2026-104041

A flaw exists in SSSD where an unprivileged local user can trigger a Denial of Service (DoS) via unbounded negative cache growth. By repeatedly requesting lookups for nonexistent entries through the Name Service Switch (NSS) responder , an attacker can cause the negative cache to grow without lim...

CVE-2026-104041

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...

EUVD-2026-92911

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...

CVE-2026-104041 Sssd: sssd: denial of service via unbounded negative cache growth

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...

CVE-2026-104041

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...

copyfail-rs

copyfail-rs PoC multi-vector + detección emparejada para CVE-2026-31431 CopyFail. Incluye un novedoso vector de omisión de autenticación PAM que ningún otro PoC público incluye. El modo de detección captura lo que AIDE / Wazuh / OSSEC / Tripwire estructuralmente no pueden. Binario estático único...

nextjs-middleware-exploit

Investigación de vulnerabilidad en middleware de Next.js CVE-2025-29927 Este repositorio demuestra una vulnerabilidad crítica en el middleware de Next.js CVE-2025-29927, que afecta a las versiones 11.1.4 hasta 15.1.7. Esta vulnerabilidad permite el bypass de autorización , el bypass de CSP y...

CVE-2023-6063-PoC

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

fockcache

fockcache FockCache - Envenenamiento de caché de prueba minimizado Detalle del envenenamiento de caché: https://portswigger.net/research/practical-web-cache-poisoning FockCache FockCache intenta realizar envenenamiento de caché probando las cabeceras X-Forwarded-Host y X-Forwarded-Scheme en págin...

fockcache

fockcache FockCache - Minimalized Test Cache Poisoning Detail For Cache Poisoning : https://portswigger.net/research/practical-web-cache-poisoning FockCache FockCache tries to make cache poisoning by trying X-Forwarded-Host and X-Forwarded-Scheme headers on web pages. After successful result, it...

CVE-2026-105752

A flaw was found in vLLM. When multi-turn requests using tool continuations are processed, the service fails to retain the cache salt parameter, causing cached data to be placed in a shared, unsalted cache namespace rather than an isolated tenant cache. An authenticated tenant with knowledge of a...

CVE-2026-104032

A flaw in SSSD allows an unprivileged local user to trigger a Denial of Service (DoS) . Due to missing authorization checks, an attacker can repeatedly request master automount map updates through the autofs responder . This action causes global cache invalidation , forcing continuous lookups to ...

CVE-2026-104032 Sssd: sssd: denial of service via unprivileged autofs cache invalidation

A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of...

CVE-2026-105755

A flaw was found in vLLM. When handling flash late-interaction scoring and reranking requests, internal cache keys are derived directly from user-supplied request identifiers. A remote attacker can exploit this issue by submitting concurrent requests reusing a victim's request identifier to...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...