CVE-2021-41773

CVE-2021-41773 Esta es mi primera vez intentando hacer un exploit para algo, así que sé amable 😁 Exploit Title: Apache HTTP Server 2.4.49 Path Traversal Author: 0xRar , 0xrar.net CVE: CVE-2021-41773 Version: Apache 2.4.49 Not Tested Yet Comando de ayuda: python3 exploit.py -h...

CVE-2026-20253

CVE-2026-20253 — Laboratorio de RCE sin autenticación previa en Splunk Enterprise Creación y truncado arbitrario de archivos sin autenticación a través del sidecar de PostgreSQL CVSS 9.8 · Crítico · CWE-306 · Explotado activamente CISA KEV ⚠️ Aviso legal Este repositorio está destinado...

mass_cve-2021-41773

masscve-2021-41773 MASS CVE-2021-41773 Captura de pantalla Uso ! python3 -m pip install requests pyyhon3 cve-2021-41773.py urlist.txt pool Nota ! los resultados se guardarán automáticamente en vuln.txt puedes añadir un directorio común en...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contribuyentes 이희수@lheeeesoo Apache HTTP Server 2.4.49 contiene una vulnerabilidad en el proceso de normalización de rutas URL, ya que no bloquea adecuadamente las rutas parentales codificadas. Un atacante puede utilizar valores como .%2e para sali...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-105636

The project management tool Plane is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The flaw exists in the webhook delivery task within apps/api/plane/bgtasks/webhook_task.py, where requests.post() is called without setting allow_redirects=False. While the applicati...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 Según la National Vulnerability Database NVD CVE-2021-41773, Apache HTTP Server 2.4.49 es vulnerable a ataques de Path Traversal y de ejecución remota de código. Path Traversal La vulnerabilidad de Path Traversal se introdujo debido al nuevo cambio de código añadido...

RCE_CVE-2024-7954-

RCECVE-2024-7954- El plugin porteplume utilizado por SPIP antes de 4.30-alpha2, 4.2.13 y 4.1.16 es vulnerable a una ejecución de código arbitrario. Un atacante remoto no autenticado puede ejecutar PHP arbitrario como el usuario de SPIP enviando una solicitud HTTP manipulada. CRÍTICO Exploit: POST...

CVE-2018-8065

Flexense HTTP Server Server-Enable web server on port. El módulo provoca una violación de acceso de escritura en el espacio de usuario en la región de memoria de syncbrs.exe. El número de peticiones que harán fallar el servidor varía entre 200 y 1000 dependiendo de la versión del sistema operativ...

CVE-2025-49132_poc

CVE-2025-49132 PoC Improved This is an improved version of the CVE-2025-49132 proof of concept exploit. CVE Information CVE ID : CVE-2025-49132 NVD Reference : https://nvd.nist.gov/vuln/detail/cve-2025-49132 Wiz Database : https://www.wiz.io/vulnerability-database/cve/cve-2025-49132 Original Work...

CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC

CVE-2023-44487 - HTTP/2 Rapid Reset Checker PoC Descriptions This main is a Proof of Concept PoC for CVE-2023-44487 , also known as the HTTP/2 Rapid Reset Attack. The vulnerability allows attackers to perform a Denial of Service DoS attack by rapidly sending RSTSTREAM frames over HTTP/2...

CVE-2021-41773-POC

CVE-2021-41773-POC Documentación del POC y configuración del laboratorio de CVE 2021 41773 ¿Qué es CVE-2021-41773? CVE-2021-41773 es una vulnerabilidad de path traversal en el servidor Apache HTTP 2.4.49 y 2.4.50. Esta vulnerabilidad explota un cambio en el código de normalización de rutas path...

CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

HTTP/2 DDoS Heuristic Tester Automated tests to heuristically detect the presence of HTTP/2 vulnerabilities associated with DDoS attacks: Developed by m10sec. CVE-2023-44487 – Rapid Reset CVE-2025-8671 – MadeYouReset Combined comparison Includes interactive menu , CLI execution, support for TXT...

CVE-2024-38856

CVE-2024-38856 Apache Ofbiz RCE Scanner Description This script is designed to scan for the CVE-2024-38856 vulnerability in Apache Ofbiz applications, which may allow for remote code execution. It sends HTTP POST requests to specific paths within the Ofbiz application with malicious payloads to...

http-pulse_ssl_vpn.nse

RESUMEN Script NSE simple para detectar la divulgación de archivos de Pulse Secure SSL VPN mediante solicitudes de recursos HTTP especialmente manipuladas. Este exploit lee /etc/passwd como prueba de concepto. Esta vulnerabilidad afecta a 8.1R15.1, 8.2 anteriores a 8.2R12.1, 8.3 anteriores a...