CVE-2019-9978-Python3

CVE-2019-9978-Python3 CVE-2019-9978 漏洞利用的 Python3 版本 待办事项 HTTP 服务器 2024 更新 这可能仍然是一个不错的编程挑战 不确定哪个 HTB/THM 机器适合测试...

K000163542: undici vulnerability CVE-2026-6733

Security Advisory Description Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the...

CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit

Exploit de DoS HTTP/2 de Restablecimiento Rápido CVE-2023-44487 Edición Profesional v1.0.1 | Autor: Sudeepa Wanigarathna -orange.svg Tabla de contenidos Descripción general Detalles de la vulnerabilidad Características Requisitos Instalación Inicio rápido Guía de uso Opciones de configuración...

CVE-2025-24893-PoC

CVE-2025-24893 – XWiki远程命令执行（概念验证） 概述 本仓库包含一个针对CVE-2025-24893 的受控概念验证（PoC） ，该漏洞是影响XWiki 的未认证远程命令执行（RCE）漏洞。 由于不安全的服务器端模板和脚本评估，该漏洞允许攻击者在服务器上执行任意操作系统命令。 关于 XWiki XWiki是一个开源的企业级维基平台，常用于： 内部文档 知识库 团队协作门户 由于XWiki经常部署在面向互联网的服务器 上，其请求处理和脚本逻辑中的安全漏洞可能产生严重的现实影响。 漏洞摘要 CVE ID: CVE-2025-24893 类别：...

CVE-2026-105245

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

CVE-2024-25175

CVE-2024-25175 通过HTTP响应拆分实现的反射型XSS 描述 : 利用此漏洞可导致受害者在点击特制链接时，其浏览器中执行JavaScript代码（跨站脚本）。漏洞产生的原因是Web服务器未能正确处理换行符（\r\n 或 CR\LF，URL编码中为 %0d%0a）。 影响 : 反射型XSS CVSSv3.1 向量 : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 6.1 CWE : CWE-20: 输入验证不当 受影响的组件 : GET参数 kickidlerauthenticationtoken 供应商 : Kickidler: 员工监控软件...

hfs-cve-2014-6287-exploit

HFS CVE-2014-6287 漏洞利用工具 概述 本仓库包含一个基于 Python 的漏洞利用工具，旨在利用 HTTP File Server HFS 版本 2.3.x 中的 CVE-2014-6287 漏洞。该漏洞允许攻击者在服务器上执行任意命令，可能导致未授权访问和控制。 ⚠️ 免责声明： 本工具仅用于教育目的和授权的渗透测试 。未经明确许可，针对您不拥有或无权测试的系统使用本工具是非法且不道德的。作者和贡献者不承担 因本工具被滥用或造成任何损害的责任。 目录 特点 前提条件 安装 使用 工作原理 配置 故障排除 贡献 作者 许可证 特点 命令执行： 在目标 HFS...

CVE-2023-38545

CVE-2023-38545：Curl 漏洞概念验证 该存储库包含一个概念验证（PoC），用于测试系统是否存在 CVE-2023-38545 漏洞。该漏洞影响 curl 工具，具体版本为 7.69.0 至 8.3.1 之间，与 HTTP 重定向的处理有关。 前置条件 所需软件：curl 功能特性 SOCKS5 代理服务器，运行在端口 1080 HTTP 服务器，运行在端口 8000 用于测试漏洞的自动化脚本 架构 该 PoC 包含两个主要组件： SOCKS5 代理服务器：监听端口 1080，将所有传入请求转发到 HTTP 服务器。 HTTP 服务器：监听端口...

CVE-2026-105245

The sgl-project sglang library (up to version 0.5.21 ) contains a vulnerability in the HTTP Endpoint component, specifically within the server_info function of the python/sglang/srt/entrypoints/http_server.py file. Manipulation of the api_key argument can result in the cleartext transmission of s...

EUVD-2026-92264

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

CVE-2026-105245 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function serverinfo of the file python/sglang/srt/entrypoints/httpserver.py of the component HTTP Endpoint. Such manipulation of the argument apikey leads to cleartext transmission of sensitive information. ...

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

CVE-2022-21907-Vulnerability-PoC

CVE-2022-21907 Descripción - POC para CVE-2022-21907: Vulnerabilidad de ejecución remota de código en la pila del protocolo HTTP. - Creado por antx el 2022-01-17, solo algunas pequeñas correcciones de Michele "[email protected]" Detalle - Vulnerabilidad de ejecución remota de código en la...

rapidresetclient

Rapid Reset Client Rapid Reset Client es una herramienta para probar mitigaciones y la exposición a CVE-2023-44487 vector de ataque DDoS Rapid Reset. Implementa un cliente HTTP/2 mínimo que abre un único socket TCP, negocia TLS, ignora el certificado e intercambia tramas SETTINGS. Luego, el clien...

CVE-2023-27163-exploit

CVE-2023-27163 — exploit SSRF de request-baskets Escribí este exploit para apuntar a CVE-2023-27163 , una vulnerabilidad de Server-Side Request Forgery SSRF encontrada en request-baskets versiones ≤ 1.2.1. La falla se encuentra en el endpoint /api/baskets/name, donde el parámetro forwardurl permi...

Malicious code in aria-live-region-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391a9a163273e36e3945f918ea720b8e10aa462b0aa603d4012b28c557c58570 The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE...

MAL-2026-17557 Malicious code in css-svqggc-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...