CVE-2023-43147

CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

CVE-2020-29254

CVE-2020-29254 TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. ========================== Cross-Side-Request-Forgery CSRF: TikiWiki 21.2 allows to edit templates without the use of a CSRF protection. This could allow an unauthenticated, remote attacker to conduct a...

ssrfnginx

ssrfnginx...

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork：app:"Microsoft Exchange Server" Using the script MicrosoftExchangeServerSSRFCVE-2021-26855.py written with Seebug toolkit and pocsuite3, to probe data from the past year: 成功率约为：1500 / 5000 = 30%...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2025-55182-exploit

⚠️ DISCLAIMER This tool is for authorized security testing and educational purposes ONLY. Only test systems you own or have explicit written permission to test Unauthorized use is illegal and unethical The developers assume no liability for misuse Use responsibly and in compliance with all...

CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit

CVE-2025-14611 CentreStack and Triofox full Poc/Exploit Summary This vulnerability arises from hardcoded cryptographic keys in Gladinet CentreStack and Triofox products, enabling arbitrary file read through forged access tickets. The AES-256 encryption implementation uses static, unchanging keys...

CVE-2025-4102025

Security Advisory: CVE-2025-4102025 Summary A critical vulnerability has been discovered in Copilot AI affecting how web query citation links are rendered after Retrieval-Augmented Generation RAG operations. When users request page summaries or perform web-based queries, all subsequent citation...

CVE-2020-0601-EXP

CVE-2020-0601-EXP This resource is the author's reproduction of the Microsoft signature certificate vulnerability CVE-2020-0601, implemented by combining related resources and articles. It is recommended that you read the author's blog to understand the ECC algorithm, Windows verification...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Arbitrary File Write to RCE PoC Derivation Process and Reflection Scope: This content is intended solely for local test environments, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80. Field| Value ---|--- CVE| CVE-2026-44578 GHSA|...

roller-csrf

Apache Roller v6.1.2 - Cross-Site Request Forgery CSRF in Profile Update Vulnerability Details Version : v6.1.2 Date : 2025-11-09 Exploit Author : Van Lam Nguyen Facebook : https://www.facebook.com/vanlam1412 Vendor Homepage : https://roller.apache.org Software Link :...

CVE-2025-45955

CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Description An attacker can exploit this vulnerability by uploading and executing a specially crafted PHP file on the Ferozo hosting platform. When accessed, the file launches a series of SSRF attempts targeting internal...

CVE-2018-0114

CVE-2018-0114 python2.7 script for JWT generation CVE-2018-0114 A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following...

CVE-2023-27524-POC

CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is vulnerable to CVE-2023-27524 and if it is vulnerable then, forge a session cookie with the userid = 1 which is usually the admin user allowing for authentication bypass and gaining access to the dashboard...

CVE-2018-0114

CVE-2018-0114 Exploit for Node-jose 0.11.0 written in Ruby Usage just input victim name into code and run the file via ruby ./exploit.rb A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...

CVE-2023-27163

CVE-2023-27163 - Request Baskets SSRF Request Baskets SSRF PoC alt text Request Baskets versions notes Credit to @beet1e from Shanghai Jiao Tong University and @chenlibo147 , @houqinsheng, [email protected] from Shandong University. Article : https://notes.sjtu.edu.cn/s/MUUhEymt7...