CVE-2023-36085_SISQUALWFM-Host-Header-Injection

CVE-2023-36085 SISQUALWFM Host Header Injection Vulnerability This repository contains information related to a host header injection vulnerability discovered in SISQUALWFM version 7.1.319.103, which allows an attacker to manipulate webpage links or redirect users to a malicious site. This...

http2smugl

http2smugl Esta herramienta ayuda a detectar y explotar el contrabando de solicitudes HTTP en aquellos casos en que se puede lograr mediante la conversión HTTP/2 - HTTP/1.1 por parte del servidor frontend. El esquema es el siguiente: 1. Un atacante envía una solicitud HTTP/2 manipulada al servido...

crlf-powered-desync-scanner

CRLF-Powered Desync Scanner This is the Burp Extension we used to detect all cases from our research CRLF-Powered Desync Attacks: Beheading HTTP Streams. It's a research-first scanner built using BulkScan similar to HTTP Request Smuggler and others. Implementation Request Header Injection probe...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-49097

camel-irc irc.sendTo Header Injection Reproducer CVE-2026-49097 This project demonstrates a message-header injection in Apache Camel's camel-irc component, tracked as CVE-2026-49097. IrcProducer reads the irc.sendTo header to choose the destination of the outgoing IRC message; when present it...

RCE

CVE-2022-31814 WebApp bug root@kitploit: import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser =...

CVE-2026-49098

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2026-48206

CVE-2026-48206 — camel-jira IssueKey Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass Vulnerability PoC This repository demonstrates the CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions Next.js 15.x 15.2.3 Next.js 14.x...

403Kangaroo

403Kangaroo !! This tool is still under development if you have any issues please don't hesitate to contact me via linkedin or smth 403/401 bypass tool via certain headers and values headers.txt,values.txt. When you load the extension for the first time it will open a headers.txt file and write t...

CVE-2021-27404

Authenticated Host Header Injection - Askey Internet Fiber Modem Vendor: Askey Software Version: BRSVg11.11RTFTEF001V6.54V014 Model: RTF8115VW Vulnerable Header: Host Not tested in other model/version. Impact: An attacker could take advantege on that vulnerability to redirect user to a fake Login...

cve-2025-29927

CVE-2025-29927 CVE-2025-29927 Vulnerability All versions of Next.js from 11.1.4 through 13.5.6, 14.x before 14.2.25, and 15.x before 15.2.3 are affected by this vulnerability. The impact is particularly significant for applications that rely on middleware for implementing access controls, as...

HTTPoxyScan

HTTPoxy Exploit Scanner by 1N3 @CrowdShield https://crowdshield.com Last Updated: 20160720 ABOUT: PoC/Exploit scanner to scan common CGI files on a target URL for the HTTPoxy vulnerability. Httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments...

CVE-2026-55994

camel-iggy User-Header Injection Reproducer CVE-2026-55994 This project demonstrates a message-header injection in Apache Camel's camel-iggy component, tracked as CVE-2026-55994. The Iggy consumer copies an inbound message's user-headers onto the Camel Exchange without anyHeaderFilterStrategy, so...

XSSTracer

XSSTracer v1.3 by 1N3 @CrowdShield https://crowdshield.com XSSTracer is a small python script that checks remote web servers for Clickjacking, Cross-Frame Scripting, Cross-Site Tracing and Host Header Injection. root@kitploit: Usage: ./xsstracer...

Log4j-Scanner-Exploit

Log4Shell-Scanner-Exploit Bash script to remotely identify and/or exploit the Log4j vulnerability. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers. Always use this script with prior authorization from the owner of the audited...

next.js_cve-2025-29927

next.jscve-2025-29927 A small and simple Next.js application running version 14.2.24 used to test CVE-2025-29927. Access the admin area /admin by utilizing the vulnerability or the hardcoded credentials admin:admin. root@kitploit: » git clone...

NextJS_CVE-2025-29927

Next.js Authorization Bypass Demo This application demonstrates the x-middleware-subrequest vulnerability in Next.js 13.4.19, which allows bypassing middleware protection. Setup 1. Install dependencies: root@kitploit: npm install 2. Start the development server: root@kitploit: npm run dev...

CVE-2025-29927

CVE-2025-29927 Critical - 9.1 Next.js 미들웨어 우회 취약점 Next.js 애플리케이션에서 CVE-2025-29927 취약점을 실습합니다. 내부 헤더 x-middleware-subrequest를 사용하여 미들웨어 인증 및 제한된 접근을 우회할 수 있습니다. 설명 Next.js는 재귀 요청이 무한 루프를 유발하지 않도록 내부 헤더 "x-middleware-subrequest"를 사용합니다. 이 보안 취약점은 미들웨어 실행을 건너뛸 수 있음을 보여주며, 요청이 라우트에 도달하기 전에 권한 부여, 쿠키...