CVE-2025-29927

CVE-2025-29927 — Next.js middleware authorization bypass Summary: vulnerability in Next.js middleware allowing authorization bypass by spoofing the x-middleware-subrequest header. Table of Contents CVE-2025-29927 — Next.js middleware authorization bypass Table of Contents Gathering vulnerable hos...

CrushFTP-AS2-Bypass-Research-CVE-2025-54309

CrushFTP AS2 Authentication Bypass Research ⚠️ IMPORTANT: This vulnerability has been patched by CrushFTP as of November 2025. This research is published for educational and defensive purposes only. 📝 NOTE: This research is based on vulnerability patterns similar to CVE-2025-54309. The exact CVE...

CVE-2024-46982-Reproduction

Getting Started 1. Install Node.js LTS 2. npm install 3. npm run build 4. npm run start Exploitation 1: Stored XSS via Cache Poisoning 1. Send the following HTTP request Attack Request using any HTTP client. GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS'...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2025-31161

CVE-2025-31161 - CrushFTP Authentication Bypass Exploit This Python script exploits CVE-2025-31161, an authentication bypass vulnerability in CrushFTP, allowing unauthenticated attackers to retrieve the user list from the getUserList API endpoint. Features Authentication bypass via CrushAuth and...

CVE-2026-78242

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0,...

EUVD-2026-90763

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0,...

CVE-2026-27739-POC

-CVE-2026-27739-poc curl -H "X-Forwarded-For: http://169.254.169.254/latest/meta-data/" self.target 2. Инъекция заголовков через загрязнение прототипа CVSS: 7.5 Описание : Angular SSR обрабатывает небезопасные параметры запроса, влияющие на цепочку прототипов Воздействие : Манипуляция заголовками...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; The fflcockpitisallowed function uses a hardcoded IP address base64: My4yMTIuMTg1LjE4Nw==, d...

BIT-TOMCAT-2026-86350 Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

BIT-PHP-MIN-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

BIT-PHP-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

BIT-RABBITMQ-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

BIT-RABBITMQ-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

BIT-LIBPHP-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

BIT-LIBPHP-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

WordPress_Backup_Migration-RCE_Unauthenticated

CVE-2023-6553 — The Backup Migration plugin for WordPress - Reverse Shell An extended version of Chocapikk's CVE-2023-6553 exploit that adds a one-command reverse shell mode on top of the original interactive webshell. Vulnerability CVE-2023-6553 — Unauthenticated Remote Code Execution in the...

CLEANSTART-2024-IK84393 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

auth-header-trust-rules

auth-header-trust-rules A small Semgrep rule pack that flags code making authentication, authorization, or trust decisions based on HTTP request headers an attacker controls. The canonical example of the vulnerability class is CVE-2025-29927: Next.js trusted the x-middleware-subrequest header to...

CVE-2026-19902

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...