WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin HTTP Requests Manager versions = 1.3.11...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability CVE-2022-36804 In affected versions of Atlassian Bitbucket Server and Data Center a Command Injection Vulnerability exists in multiple API endpoints where an attacker with access to a public repository or...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.0 RCE vulnerability This is a script to exploit CVE-2017-5638 - It allows an attacker to inject OS commands into a web application through the content-type header Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It...

CVE-2021-41773

CVE-2021-41773 Reproduction https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited v2.4.49 Apache unique vulnerability, earlier versions do not have the apnormalizepath function. This function was introduced in v2.4.49, and it is exactly this function...

CVE-2026-77802

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2024-23692-RCE

TG Присоединяйтесь к нам https://t.me/WanLiChangChengWanLiChang Присоединяйтесь к нам, чтобы регулярно получать различные EXP POC для уязвимостей. CVE-2024-23692-RCE-EXP CVE-2024-23692 Rejetto HTTP HFS-сервер RCE FOFA "HttpFileServer" Примечания Затрагиваются версии HFS2.3 и ниже. Как использоват...

CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability. If you want to understand exactly how this vulnerability works, you can read the original researchers excellent article here This template is pretty straight forward. It does two...

CVE-2022-21907

CVE-2022-21907 Description POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. create by Malwareman at 2022-09-17. Detail HTTP Protocol Stack Remote Code Execution Vulnerability. Similar to https://github.com/antx-code/CVE-2021-31166CVE-2021-31166. This problem exists...

CVE-2002-0200

CVE-2002-0200 Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name. External reference at https://marc.info/?l=bugtraq&m=101174569103289&w=2 Author Alex Hernandez aka @alt3kx...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

EUVD-2026-92425

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...

Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation

Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt 📌 Executive Summary On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway CP-Spark-Gateway-01, IP: 172.16.20.146...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" pre-auth crash Root-cause analysis + DoS proof-of-concept. The public advisory classifies this as an unauthenticated denial-of-service / uncontrolled resource consumption. Binary analysis shows the underlying defect is memory-safety :...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

Astra Linux – Vulnerability in curl

There is a vulnerability in curl version 7.87.0 where it is possible to exploit the memory reclamation mechanism. In this vulnerability, curl can be instructed to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can and often do deny such tunnel operations. When curl...

Astra Linux – Vulnerability in JRuby

Before Ruby 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an HTTP Response Splitting attack was possible. An attacker could inject a crafted key and value into an HTTP response for the WEBrick HTTP server...