boatcrash

boatcrash Exploit for CVE-2019-19030 that affects Harbor versions Use this script on Harbor instances running versions under 1.10.3 or 2.0.1 to enumerate all projects present in the platform. It can also be used to enumerate projects on higher versions but you will only be able to enumerate publi...

Harbor <=1.82.0 - Privilege Escalation

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration. id: CVE-2019-16097...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

harbor

Team Introduction Chongqing Jiugongge Security Team is committed to sharing open-source security tools, with research directions covering red-blue confrontation, Web security, mobile security, security development, enterprise security construction, IoT/Industrial Control Security/AI/Quantum...

CVE-2019-16097

CVE-2019-16097 This program is only for security research, do not use it illegally! Vulnerability Impact Attackers can create an administrator account, upload malicious images, and infect clients using the repository. Affected Component Harbor Affected Versions 1.7.0-1.8.2 Remediation Upgrade to...

policymaker

policymaker Generate a real vulnerability-disclosure policy — VDP, safe harbor, security.txt & DNS Security TXT — in minutes. No lawyer required. Part ofthe disclose.io Project — the open, vendor-neutral infrastructure for vulnerability disclosure. Browse the ecosystem → policymaker.disclose.io i...

CVE-2019-16097-batch

CVE-2019-16097-batch Disclaimer For security research purposes only. Do not use for illegal testing. Bear all consequences yourself!!! CVE-2019-16097-batch Batch exploit script Add target URLs in bulk in the url.txt file http://1.1.1.1 http://2.2.2.2 Run this script with Python. The verification...

CVE-2022-46463

CVE-2022-46463 CVE-2022-46463POC Harbor Unauthorized For vulnerability details, see Stack Community Use python3 cvve-2022-46463.py -u https://127.0.0.1:5003 Options -u URL, --url URL Target URL e.g. http://example.com -h, --help Show help message and exit Directly pasted the docker pull xxx comma...

CVE-2022-46463

CVE-2022-46463 Harbor public image download Harbor is an open-source image hosting platform. This script enumerates all public images and supports dump operations similar to docker pull, making it easy to find sensitive leaked information from publicly exposed images. Usage $ python3 harbor.py...

CVE-2019-16097

CVE-2019-16097-batch Disclaimer Only for security research purposes. Do not use for illegal testing. You bear all consequences!!! CVE-2019-16097-batch Batch vulnerability exploitation script Add target addresses in batch to the url.txt file http://1.1.1.1 http://2.2.2.2 Run this script with Pytho...

harbor-give-me-admin

Harbor Admin Account Creation Vulnerability Detection Tool 0x00 Overview In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "hasadminrole": true, an administrator...

CVE-2019-16097

CVE-2019-16097 Harbor Unauthorized Admin Creation Vulnerability Principle docker and poc based on pocsuite framework...

CLEANSTART-2026-YE00563 Moby is an open source container framework developed by Docker Inc

Security vulnerability affects the harbor-fips package. Moby is an open source container framework developed by Docker Inc...

CLEANSTART-2026-FY08741 beego is an open-source web framework for the Go programming language

Security vulnerability affects the harbor-fips package. beego is an open-source web framework for the Go programming language...

CLEANSTART-2026-QG46806 Beego is an open-source web framework for the Go programming language

Security vulnerability affects the harbor-fips package. Beego is an open-source web framework for the Go programming language...

CVE-2026-111590

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

EUVD-2026-109830

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590

A wide range of Harbor versions are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of validation on webhook target addresses. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event trig...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...