log4j-scan

1 Mode d'emploi Outil de détection de la vulnérabilité RCE log4j 2.x CVE-2021-44228, qui envoie une requête GET à la cible et utilise dnslog pour détecter s'il y a un écho. root@kitploit: $ python3 log4j-scan.py -h Usage: python log4j-scan.py -u Options: -h, --help show this help message and exit...

CVE-2026-53760

Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...

PyFlooder

PyFlooder نص بايثون لـفيضان HTTP يمكنه إيقاف موقع ويب عادي خلال 10 ثوانٍ كيف يعمل ؟ يقوم بتوليد عدد قابل للتكوين من طلبات GET العشوائية وإرسالها إلى الهدف الاستخدام root@kitploit: pyflooder.py...

SQLi_Sleeps

SQLiSleeps Это простой скрипт, который позволяет находить уязвимости SQLi, получая время ответа более 20 секунд для medium и time-based инъекций. root@kitploit: usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos. options: -h, --help...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

HttpStrike

HttpStrike Un script DDoS rapide écrit en Python, il enverra beaucoup de requêtes GET si vous augmentez les requêtes comme vous le souhaitez...

http-protocol-exfil

http-protocol-exfil استخدم إصدار بروتوكول HTTP لإرسال ملف بتةً بتة "HTTP/1.0" تعني 0 و"HTTP/1.1" تعني 1. يستخدم طلبات GET، لذلك سيرى الفريق الأزرق فقط الطلبات الموجهة إلى عنوان IP الخاص بك. ومع ذلك، يستغرق إرسال الملفات الكبيرة وقتًا طويلاً، فعلى سبيل المثال يحتاج إلى ساعة واحدة لإرسال 200...

extended-xss-search

ممتد XSS باحث ومكتشف هذا هو الإصدار الممتد بناءً على الفكرة الأولية التي تم نشرها بالفعل باسم "xssfinder". يسمح هذا الإصدار الخاص للمهاجم بأداء ليس فقط طلبات GET ولكن أيضًا POST. بالإضافة إلى ذلك، من الممكن توجيه كل طلب عبر Burp أو نفق آخر. الخطوات الأولى أعد تسمية example.app-settings.conf إلى...

MalleableC2Profiles

Profils Malleable C2 Profils Malleable C2 pour Cobalt Strike version 3.6+ bingsearchgetonly.profile - Profil de recherche web Bing, utilise uniquement des requêtes GET cnnvideogetonly.profile - Profil de diffusion vidéo en direct MSNBC, utilise uniquement des requêtes GET...

CVE-2026-33340

CVE-2026-33340 : SSRF dans lollms-webui Aperçu Champ| Détail ---|--- CVE ID| CVE-2026-33340 Vulnérabilité| Server-Side Request Forgery SSRF Produit affecté| ParisNeo/lollms-webui LoLLMs WEBUI Sévérité| Critique — CVSS 9.1 Vecteur CVSS| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918 :...

Astra Linux – Vulnerability in Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, which is caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

EUVD-2026-61007

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

EUVD-2026-55994

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

EUVD-2026-52866

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

EUVD-2026-52652

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52427

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...