CVE-2026-47360

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

CVE-2026-47360

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability within the mod_session_cookie module. The root cause is that when the SessionCookieRemove directive changes across internal redirects, the session c...

CVE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

EUVD-2026-90887

NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-46729 Apache HTTP Server: mod_heartmonitor denial of service

NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-46729

Apache HTTP Server versions 2.4.0 through 2.4.68 are vulnerable to a NULL Pointer Dereference within the mod_heartmonitor module. The flaw occurs over a unicast listener , which can lead to a denial of service (DoS) condition. While the vulnerability is confirmed to impact availability, specific ...

CVE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

The Apache HTTP Server versions 2.4.60 through 2.4.68 are affected by a deployment of wrong handler vulnerability (CVE-2026-42356). This flaw allows the target of certain internal redirects originating from CGI programs to be incorrectly treated as CGI and executed. For this to occur, the target ...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

EUVD-2026-90886

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

CVE-2026-42528

A memory calculation bug in the mod_dav module of Apache httpd version 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to trigger a crash in server child processes. This vulnerability is characterized as a mod_dav shared lock overflow . To mitigate this issue, users a...

CVE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

cve-2021-41773-source-code-analysis

Apache HTTP Server CVE-2021-41773 源代码分析 一个基于 Python 的静态补丁分析工具，用于通过对比存在漏洞的 Apache HTTP Server 2.4.49 源代码与已修补的 2.4.51 实现，研究 CVE-2021-41773（Apache HTTP Server 路径遍历） 的根本原因与修复措施。 该项目执行的是语义级源代码分析，而非简单的基于文本的差异比较。它从目标函数中提取结构信息，比较两个版本，推断与安全相关的变更，并生成专业的分析报告。 功能特性 静态源代码分析 使用花括号匹配进行函数提取 漏洞版本与已修补版本之间的结构比较...

CVE-2021-41773-apache

CVE-2021-41773 Apache HTTP 服务器漏洞利用工具 此仓库包含一个基于 Python 的概念验证（PoC）漏洞利用脚本，针对编号为 CVE-2021-41773 的 Apache HTTP 服务器路径遍历漏洞。该脚本专为安全研究、防御性测试以及针对易受攻击系统的授权评估而设计。 概述 CVE-2021-41773 是一个路径遍历漏洞，影响 Apache HTTP Server 2.4.49 版本及相关配置，在这些配置中，服务器未能正确处理某些 CGI 请求路径中的编码遍历序列。本项目提供了一个基础的 PoC 实现，可用于验证暴露情况并与易受攻击的目标进行交互。 项目...

Myesve

myesve CVE-2024-38475 漏洞利用框架 – 版本 1.0 免责声明： 本工具仅限用于经授权的安全测试、教育研究和合法的漏洞赏金项目。请勿将其用于您不拥有或未经明确许可测试的系统。作者对任何滥用行为不承担任何责任。 myesve 是一款模块化工具，用于检测和利用 Apache HTTP Server 中的源代码泄露漏洞 CVE-2024-38475。它集成了目录扫描、多线程漏洞利用、文件下载以及可选的 Mullvad VPN 轮换功能。 由 Orange Tsai 最初发现。 功能特性 403 目录发现 – 多线程扫描禁止访问的路径。 源代码泄露 – 利用...

EP3_Redes

EP3Redes GOによるHTMLサーバの実装 - CVE-2023-29406脆弱性の分析...

CVE-2024-40898-SSL-Bypass-Detection

CVE-2024-40898 SSL 证书验证绕过扫描器 本仓库包含一个基于 Python 的概念验证 PoC 脚本，用于检测 CVE-2024-40898——Apache HTTP Server 中允许攻击者绕过 SSL 证书验证的漏洞。 概述 CVE-2024-40898 是 Apache HTTP Server 中的一个安全问题，在特定条件下允许客户端绕过证书验证。这可能会在 TLS 上造成中间人 MitM 攻击。 此脚本的功能 • 从 ssl-ports.txt 读取 host:port 对列表。 • 对于每个条目： • 使用禁用证书验证的自定义 SSL 上下文建立 TLS 连接...

CVE-2020-35667-PoC

CVE-2020-35667-PoC 概述 免责声明 下面说明的脆弱行为是通过对反编译后的补丁版工件进行经验性验证得出的，该行为试图通过启发式方法模拟原始漏洞，因为原始的漏洞插件版本已不再可用。本仓库包含一个压缩包，其中包含一个经过最小修改的构建（源自补丁版本），用于隔离的实验室复现。 此 CVE 涉及 IntelliJ IDEA TeamCity 集成插件，该插件实现 IDE 与 TeamCity 的集成。TeamCity 是一个 CI/CD 编排器和归档系统，存储构建配置和其他工件，并通过 REST/RPC API 暴露。 该插件在本地打开几个 HTTP...