CVE-2025-49132_poc

CVE-2025-49132 PoC Improved This is an improved version of the CVE-2025-49132 proof of concept exploit. CVE Information CVE ID : CVE-2025-49132 NVD Reference : https://nvd.nist.gov/vuln/detail/cve-2025-49132 Wiz Database : https://www.wiz.io/vulnerability-database/cve/cve-2025-49132 Original Work...

CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC

CVE-2023-44487 - HTTP/2 Rapid Reset Checker PoC Descriptions This main is a Proof of Concept PoC for CVE-2023-44487 , also known as the HTTP/2 Rapid Reset Attack. The vulnerability allows attackers to perform a Denial of Service DoS attack by rapidly sending RSTSTREAM frames over HTTP/2...

CVE-2021-41773-POC

CVE-2021-41773-POC The POC and Lab setup documentation of CVE 2021 41773 What is CVE-2021-41773? CVE-2021-41773 is a path traversal vulnerability in Apache HTTP server 2.4.49 and 2.4.50. This vulnerability exploits an update in the path normalisation code introduced in this version. The Path...

CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

HTTP/2 DDoS Heuristic Tester Pruebas automáticas para detectar heurísticamente la presencia de vulnerabilidades en HTTP/2 asociadas a ataques DDoS : Desarrollado por m10sec. CVE-2023-44487 – Rapid Reset CVE-2025-8671 – MadeYouReset Comparativa combinada Incluye menú interactivo , ejecución vía CL...

CVE-2024-38856

CVE-2024-38856 Apache Ofbiz RCE Scanner Description This script is designed to scan for the CVE-2024-38856 vulnerability in Apache Ofbiz applications, which may allow for remote code execution. It sends HTTP POST requests to specific paths within the Ofbiz application with malicious payloads to...

http-pulse_ssl_vpn.nse

SUMMARY Simple NSE script to detect Pulse Secure SSL VPN file disclosure via specially crafted HTTP resource requests. This exploit reads /etc/passwd as a proof of concept This vulnerability affect 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. INSTALLATION $ git clone...

CVE-2021-41773

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

CVE-2026-41940_exploit

============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...

CVE-2026-46585

camel-lucene QUERY Header Injection Reproducer CVE-2026-46585 This project demonstrates a message-header injection / authorization bypass in Apache Camel's camel-lucene component, tracked as CVE-2026-46585. The Lucene query producer reads the full-text search phrase from an Exchange header, but t...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 payloads and analysis. HTTP requests request| src| user-agent| encoding| unique id| payload ---|---|---|---|---|--- 816978882| 45.63.58.216| Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36| '|...

sccm_sql_backdoor

sccmsqlbackdoor A proof‑of‑concept tool that implants a controlled backdoor into a Management Point stored procedure, enabling indirect SQL execution through a legitimate MP HTTP service. Installation You can install by cloning the repository and installing the dependencies. $ git clone...

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

CVE-2021-3831

PHP Exploit CVE-2021-3831 Script Overview This PHP script is designed to interact with a target website by generating specific MD5 hashes and making HTTP requests to exploit potential vulnerabilities. It is intended for educational purposes and should only be used in environments where you have...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: CVE-2026-60589: improve resource resolving bsc1275777. CVE-2026-61308: enhance HTTP connections bsc1275778. CVE-2026-70907: enhance TLS server bsc1275764. Changes for java-11-openjdk: Upgrade to jdk-11.0.32.1+1 August 2026 CSPU Patch...

SUSE-SU-2026:4515-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - CVE-2026-60589: improve resource resolving bsc1275777. - CVE-2026-61308: enhance HTTP connections bsc1275778. - CVE-2026-70907: enhance TLS server bsc1275764. Changes for java-11-openjdk: - Upgrade to jdk-11.0.32.1+1 August 2026 CSPU...

CVE-2026-84304

A flaw was found in gRPC-Go. This vulnerability allows an unauthenticated remote attacker to exhaust process memory by sending millions of fragmented HTTP/2 DATA frames. Each fragmented frame is stored as a separate message, consuming disproportionate heap memory. This can lead to a runtime panic...

CVE-2025-32375

Setup for the vulnerable version. Start the vulnerable container: docker compose up Create a listener e.g. ncat: ncat -klnv 1337 Run the exploit: python3 exploit.py You should receive an HTTP request in the ncat window with the contents of the OS command id by default if everything worked as...

CVE-2019-3929

CVE-2019-3929 Módulo de Metasploit para Inyección Remota de Comandos en Crestron/Barco/Extron/InFocus/TeqAV CVE-2019-3929 Según la descripción de Tenable: Un atacante remoto no autenticado puede ejecutar comandos del sistema operativo como root mediante solicitudes manipuladas al endpoint HTTP...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2024-38475

CVE-2024-38475 POC Credit : All credit to this guy: https://blog.orange.tw/ and https://x.com/orange8361 all i did was make a POC script from his research. Introduction : Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesyste...