394 matches found
blind-ssrf-chains
परिचय सर्वर साइड रिक्वेस्ट फॉरजेरी SSRF क्या है? सर्वर साइड रिक्वेस्ट फॉरजेरी तब होती है जब आप किसी सर्वर को आपकी ओर से मनमाने अनुरोध करने के लिए मजबूर कर सकते हैं। चूँकि अनुरोध सर्वर द्वारा किए जा रहे होते हैं, इसलिए नेटवर्क में सर्वर की स्थिति के कारण आंतरिक संसाधनों तक पहुँच संभव हो सकती है।...
CVE-2022-25260
CVE-2022-25260 JetBrains Hub प्री-ऑथ अर्ध-अंधा सर्वर-साइड रिक्वेस्ट फोर्जरी SSRF आवश्यकताएँ JetBrains Hub 2021.1.14276 JetBrains Hub 2021.1.14276 से पहले का संस्करण अनुचित एक्सेस नियंत्रण CVE-2022-34894 के प्रति संवेदनशील था, जो एक हमलावर को बिना प्रमाणीकरण के अविश्वसनीय सेवाएँ बनाने की अनुमति दे...
poc-cve-2026-32255
Kan SSRF عبر تنزيل المرفقات CVE-2026-32255 - إثبات المفهوم يحتوي هذا المستودع على إثبات المفهوم POC لثغرة CVE-2026-32255 ، وهي ثغرة تزوير الطلبات من جانب الخادم SSRF عالية الخطورة في Kan ، وهي أداة مفتوحة المصدر لإدارة المشاريع. تسمح نقطة النهاية المعرضة للخطر للمهاجمين غير المصادق عليهم بإجراء...
CVE-2021-40438-POC
नोट: केवल शैक्षिक और नियंत्रित परीक्षण उद्देश्यों के लिए है। केवल उन सिस्टम पर परीक्षण करें जिनका आकलन करने की आपको अनुमति है। CVE-2021-40438 - SSRF एक्सप्लॉइट ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄...
CVE-2026-101029
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...
PT-2026-107130
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...
CVE-2024-51665
CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - प्रमाणित सब्सक्राइबर+ सर्वर-साइड रिक्वेस्ट फॉर्जरी विवरण: Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library वर्डप्रेस के लिए प्लगइन संस्करण 1.2.1 तक और सहित सर्वर-साइड रिक्वेस्ट फॉर्जरी के...
wargame_Re-LS
CVE-2025-0184 DOCX SSRF CTF चुनौती त्वरित आरंभ 1. सेटअप और निर्माण make setup make build 2. सेवा शुरू करें make up 3. वेब तक पहुँचें open http://localhost:8080 लक्ष्य आंतरिक Admin सेवा पोर्ट 3003 तक पहुंचकर फ्लैग प्राप्त करें! अपेक्षित फ्लैग : CTFflagreadme शोषण cd exploits python3...
CVE-2026-102150
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-102150
A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...
CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
EUVD-2026-90386
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
CVE-2026-55177
CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...
CVE-2026-102150: Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...
PT-2026-103582
Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A function within the Kiteworks Advanced Forms component is accessible without authentication. This allows an unauthenticated attacker to perform a limited set of internal service operation...
EUVD-2026-87979
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...
CVE-2026-101048: Incorrect Authorization
Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...