RCE

CVE-2022-31814 WebApp-Fehler root@kitploit: import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser =...

CVE-2024-34328

CVE-2024-34328 Offene Weiterleitung über Host-Header 📝 Übersicht Schwachstellentitel : Offene Weiterleitung über Host-Header Produkt : Sielox AnyWare Betroffene Version : 2.1.2 CVE-ID : CVE-2024-34328 Schweregrad : Mittel Angriffsvektor : Remote Auswirkung : Offene Weiterleitung / Phishing 🧨...

CVE-2018-18778

CVE-2018-18778 – ACME minihttpd Beliebige Dateien lesen CVE-2018-18778 ist eine Sicherheitsschwachstelle, die ACME minihttpd einen leichtgewichtigen Webserver betrifft. Die Schwachstelle ermöglicht es Angreifern aus der Ferne, beliebige Dateien auf dem Server zu lesen. Es wurde im Oktober 2018...

CVE-2023-36085_SISQUALWFM-Host-Header-Injection

Vulnerabilidade de Injeção de Cabeçalho de Host no SISQUALWFM CVE-2023-36085 Este repositório contém informações relacionadas a uma vulnerabilidade de injeção de cabeçalho de host descoberta no SISQUALWFM versão 7.1.319.103, que permite a um atacante manipular links de páginas da web ou...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Injeção de Cabeçalho Host levando ao bypass de autenticação SAML no AWS Auth Manager do Apache Airflow Um atacante pode injetar um cabeçalho Host malicioso no fluxo de login SAML, fazendo com que a URL do Assertion Consumer Service ACS aponte para um servidor controlado pelo...

CVE-2025-22381

CVE-2025-22381: Injeção de Cabeçalho de Host no Aggie Análise detalhada e Prova-de-Conceito para CVE-2025-22381, uma vulnerabilidade de Injeção de Cabeçalho de Host descoberta no Projeto Open-Source Aggie. Visão Geral da Vulnerabilidade+ CVE ID: CVE-2025-22381 Publicado: Outubro de 2025 atribuiçã...

Mini_httpd-CVE-2018-18778

Vulnerabilidade de leitura arbitrária de arquivos no minihttpd CVE-2018-18778 Minihttpd é um servidor HTTP mínimo que, consumindo poucos recursos do sistema, consegue manter um certo nível de desempenho cerca de 90% do Apache; por isso, é amplamente utilizado por diversos dispositivos IoT...

zaphoster

zaphoster Host-Header-Erzwingung in zaproxy beheben Füge das Skript ZAP/zap-hoster.py zum httpsender-Tab hinzu und führe app.py aus. root@kitploit: $ sudo pip3 install flask requests $ python3 app.py root@kitploit: GET https://knassar702.github.io/ HTTP/1.1 Host: knassar702.github.io User-agent:...

CVE-2021-23017

CVE-2021-23017 PoC स्कैनर NGINX DNS ओवरफ़्लो भेद्यता जांच - CVE-2021-23017 PoC यह Python स्क्रिप्ट जाँचती है कि क्या nginx सर्वर गंभीर भेद्यता CVE-2021-23017 के लिए संभावित रूप से कमजोर है, जो nginx में निर्मित DNS resolver को प्रभावित करती है और बफर ओवरफ़्लो का कारण बन सकती है। 🔍 यह क्या करता है...

CVE-2021-27404

प्रमाणित होस्ट हेडर इंजेक्शन - Askey इंटरनेट फाइबर मॉडेम विक्रेता: Askey सॉफ़्टवेयर संस्करण: BRSVg11.11RTFTEF001V6.54V014 मॉडल: RTF8115VW संवेदनशील हेडर: Host अन्य मॉडल/संस्करण में परीक्षण नहीं किया गया। प्रभाव: एक हमलावर इस भेद्यता का लाभ उठाकर उपयोगकर्ता को नकली लॉगिन पृष्ठ पर पुनर्निर्देशित कर...

CVE-2026-19760 WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache WordPress plugin (all versions up to and including 1.5.0) is vulnerable to unauthenticated stored cross-site scripting via the HTTP Host header. Insufficient input sanitization and output escaping in the Host-header-to-URL code path allows an attacker to inject arbitrary scri...

CVE-2026-19760 WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2025-12543-Fix-for-Wildfly

Imagem Base WildFly 11.0.0.Final — Correção CVE-2025-12543 Visão Geral Este repositório fornece uma imagem Docker base construída sobre o WildFly 11.0.0.Final com uma correção portada para CVE-2025-12543 , uma vulnerabilidade crítica de validação do cabeçalho Host no Undertow. A imagem destina-se...

cloudfrunt

CloudFrunt CloudFrunt ist ein Werkzeug zur Identifizierung falsch konfigurierter CloudFront-Domänen. Hintergrund CloudFront ist ein Content Delivery Network CDN, das von Amazon Web Services AWS bereitgestellt wird. CloudFront-Benutzer erstellen "Distributionen", die Inhalte von bestimmten Quellen...

CVE-2024-25170-Mezzanine-v6.0.0

Product: Mezzanine CMS Version: v6.0.0 Datum gefunden: 10.01.2024. Datum gemeldet: 10.01.2024. Verwundbarkeitstyp: Fehlerhafte Zugriffskontrolle. CVE ID: CVE-2024-25170 Beschreibung: Ein Problem in Mezzanine v6.0.0 ermöglicht es Angreifern, Zugriffskontrollen durch Manipulation des Host-Headers z...

CVE-2026-48710

CVE-2026-48710 المبدأ: Starlette هو إطار عمل Python ASGI مفتوح المصدر وخفيف الوزن. ينبع من أن إطار Starlette، عند معالجة بنية بيانات الـ url، يثق في قيمة host التي يرسلها العميل ويضمّنها مباشرة في متغير الـ url للاستخدام لاحقًا في التحقق من الصلاحيات. يُعالَج الـ url الأصلي في...

CVE-2022-22972

CVE-2022-22972 POC für CVE-2022-22972, das VMware Workspace ONE, vIDM und vRealize Automation 7.6 betrifft. Technische Analyse Eine technische Grundursachenanalyse der Schwachstelle finden Sie in unserem Blog:...

CVE-2026-74932

WP Fastest Cache (WordPress plugin) versions before 1.5.1 fail to validate the Host header before using it to build URLs for asset files embedded in cached pages, and omit that header from the cache key. This allows an unauthenticated attacker to poison cached pages with references to an attacker...

CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection

CVE-2026-26898: Xiaomi Mi Router 4A Gigabit - SSRF durch Host-Header-Injection -orange Zusammenfassung Es besteht eine Server-Side-Request-Forgery-SSRF-Sicherheitslücke im Xiaomi Mi Router 4A Gigabit Edition. Die Weboberfläche des Routers validiert den HTTP Host-Header nicht, sodass ein nicht...

XSSTracer

XSSTracer v1.3 por 1N3 @CrowdShield https://crowdshield.com XSSTracer é um pequeno script em Python que verifica servidores web remotos em busca de Clickjacking, Cross-Frame Scripting, Cross-Site Tracing e Host Header Injection. root@kitploit: Usage: ./xsstracer...