lighty-sqlinj-demo

title: Ep4 - Network-Related Vulnerability members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Related vulnerability: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Confirm:...

uc_httpd_exploit

uc httpd exploit lighthttpd Simple uc httpd exploit made with py3.. this exploit was written from CVE-2014-2324 Description Multiple directory traversal vulnerabilities in 1 modevhost and 2 modsimplevhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. dot dot in...

CVE-2024-10914

CVE-2024-10914 - D-Link Remote Code Execution RCE Exploit This script is a proof-of-concept PoC exploit for CVE-2024-10914, a remote code execution vulnerability in certain D-Link devices. The script identifies and exploits vulnerable devices to execute arbitrary commands. Note: This script shoul...

CVE-2024-10914

CVE-2024-10914 - D-Link Remote Code Execution RCE Exploit This script is a proof-of-concept PoC exploit for CVE-2024-10914, a remote code execution vulnerability in certain D-Link devices. The script identifies and exploits vulnerable devices to execute arbitrary commands. Note: This script shoul...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Autor : @abiyeenzo ⚠️ Advertencia Este proyecto se proporciona únicamente con fines educativos. La ejecución del PoC contra servidores de terceros puede constituir un ataque informático ilegal y conllevar acciones penales. Utilice este script solo en sus...

Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

Lighttpd 1.4.34 SQL Injection and Path Traversal

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical...

CVE-2024-10914

CVE-2024-10914 Command Injection Vulnerability Testing for D-Link NASManual testing with burpsuite Dork for Finding Vulnerable Devices Use the following search dork to find potentially vulnerable D-Link NAS devices: FOFA: app="DLink-DNS-ShareCenter" && server=="lighttpd/1.4.25-devel-fb150ff"...

CVE-2022-30780-lighttpd-denial-of-service

CVE-2022-30780 - lighttpd remote denial of service CVE-2022-30780 - lighttpd remote denial of service Summary An unauthenticated attacker can send an HTTP request with an URL overflowing the maximum URL length, resulting in a denial of service. Vulnerable versions The following versions of lightt...

[SECURITY] Fedora 45 Update: lighttpd-1.4.85-3.fc45

lighttpd pronounced /lighty/ is a secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments. lighttpd uses memory and CPU efficiently and has lower resource use than other popular web servers. Its advanced feature-set FastCGI, CGI, Auth,...

zyxel-wax650s-research-notebook-public

Cuaderno de Investigación Zyxel WAX650S Cuaderno de investigación de acceso público para el firmware Zyxel WAX650S V7.10ABRM.4C0. Este repositorio está escrito como una wiki en formato narrativo para investigadores y futuros trabajos de seguimiento asistidos por LLM. Documenta cómo se levantó el...

CVE-2022-30780_Checker

CVE-2022-30780 - lighttpd remote denial of service Description Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service CPU consumption from stuck connections because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on...

CVE-2026-100669

Grav versions before 2.0.25 ship web server configuration samples with case-sensitive deny rules, leading to sensitive file disclosure . In webserver-configs/web.config (IIS), the ignoreCase="false" setting on URL Rewrite elements allows unauthenticated remote attackers to bypass access controls ...

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

CVE-2026-18754 affects GV-AS1620 Controller Firmware (GV-Cloud). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. The exposed private key can compromise HTTPS confidentiality and integrity, enabling traffic decryption and potential ser...

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...