CVE-2020-35391

CVE-2020-35391 Tenda f3 Malformed HTTP Request Header Processing Vulnerability. Run root@kitploit: python3 CVE-2020-35391.py --help python3 CVE-2020-35391.py python3 CVE-2020-35391.py -i http://127.0.0.1:8080 python3 CVE-2020-35391.py -l ip.txt Tenda F3 Shodan Dork Exploitation...

CVE-2025-48799-

CVE-2025-48799 – Apache Tomcat Remote Code Execution PoC This repository contains a proof-of-concept exploit for CVE-2025-48799, a remote code execution vulnerability discovered in Apache Tomcat 9.0.48. The flaw stems from an integer overflow in the HTTP header parser, which can be triggered by a...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

boa-detector

boa-detector This Zeek package detects the Boa web server string in HTTP headers. All Boa versions are considered vulnerable: https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ When the /^Boa/./ server string i...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

CVE-2026-94216

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

CVE-2026-94216

An open redirect vulnerability affects ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to build 20260717). The flaw resides in the authorize function of the file /usr/sbin/webserver, specifically in the HTTP Header Handler component. Manipulating the Success argument allows ...

EUVD-2026-83907

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

CVE-2026-94216 ST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Header webserver authorize redirect

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2017-5638

CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Burst Statistics Authentication Bypass -brightgreen.svg?style=for-the-badge !CAUTION CRITICAL ALERT: This vulnerability allows an unauthenticated remote attacker to bypass authentication and gain full Administrator privileges on the target WordPress site by simply injecting a...

log4jcheck

Northwave Log4j CVE-2021-44228 checker Friday 10 December 2021 a new Proof-of-Concept 1 addressing a Remote code Execution RCE vulnerability in the Java library 'log4j' 2 was published. This vulnerability has not been disclosed to the developers of the software upfront. The vulnerability is being...

JEFAZO-CVE-2025-55182-Checker

JEFAZO-CVE-2025-55182-Checker Description JEFAZO-CVE-2025-55182-Checker is a passive analysis tool designed to identify indicators related to CVE-2025-55182 in applications built with Next.js and React Server Components RSC. The tool performs safe and non-intrusive checks, without attempting to...

CVE-2022-46169

CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions before 1.2.3 Here remoteclientauthorized checks the clients hostname in poller table for entry root@kitploit: function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname = gethostbyaddr$clientaddr; // ... $pollers...

CVE-2022-1388

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass RCE This Python script exploits CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST that allows unauthenticated remote command execution via improper access control and HTTP header handling. ⚠️ For educational and...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...

cve-2025-29927-lab

CVE-2025-29927 Lab Minimal reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass CVSS 9.1. Companion to: N-Day Analysis writeup on Medium What this is A Next.js 15.2.2 app vulnerable with a cookie-gated /dashboard route. The middleware auth check can be bypassed by sending...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

CVE-2017-5638

CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...