uc_httpd_exploit

uc httpd exploit lighthttpd py3로 만든 간단한 uc httpd 익스플로잇입니다. 이 익스플로잇은 CVE-2014-2324를 기반으로 작성되었습니다. 설명 lighttpd 1.4.35 이전 버전의 1 modevhost 및 2 modsimplevhost에서 발생하는 다중 디렉터리 트래버설 취약점으로, 원격 공격자가 호스트 이름에 포함된 .. 점 두 개을 통해 임의 파일을 읽을 수 있습니다. 이는 requestcheckhostname과 관련됩니다...

CVE-2024-10914

CVE-2024-10914 D-Link NAS 命令注入漏洞测试 — 使用 Burp Suite 手动测试 查找易受攻击设备的 Dork 使用以下搜索 Dork 查找可能易受攻击的 D-Link NAS 设备： root@kitploit: FOFA: app="DLink-DNS-ShareCenter" && server=="lighttpd/1.4.25-devel-fb150ff" SHODAN: "http.title:D-Link" product:"lighttpd" 此搜索字符串有助于识别运行受影响版本 Lighttpd 服务器的易受攻击 D-Link DNS...

lighty-sqlinj-demo

title: Ep4 - Vulnerabilità relativa alle reti members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Vulnerabilità correlata: root@kitploit: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Conferma:...

CVE-2024-10914

CVE-2024-10914 - Exploit de Execução Remota de Código RCE em D-Link Este script é um exploit de prova de conceito PoC para CVE-2024-10914, uma vulnerabilidade de execução remota de código em certos dispositivos D-Link. O script identifica e explora dispositivos vulneráveis para executar comandos...

CVE-2024-10914

CVE-2024-10914 - Exploit per l'esecuzione remota di codice RCE di D-Link Questo script è un exploit proof-of-concept PoC per CVE-2024-10914, una vulnerabilità di esecuzione remota di codice in alcuni dispositivi D-Link. Lo script identifica e sfrutta i dispositivi vulnerabili per eseguire comandi...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Autore: @abiyeenzo ⚠️ Avvertenza Questo progetto è fornito solo a scopo educativo. L'esecuzione del PoC contro server di terze parti può costituire un attacco informatico illegale e comportare azioni penali. Utilizza questo script solo nei tuoi ambienti di...

CVE-2022-30780_Checker

CVE-2022-30780 - negazione del servizio remota in lighttpd Descrizione Lighttpd 1.4.56 fino a 1.4.58 consente a un attaccante remoto di causare una negazione del servizio consumo di CPU dovuto a connessioni bloccate perché connectionreadheadermore in connections.c presenta un errore di battitura...

CVE-2022-30780-lighttpd-denial-of-service

CVE-2022-30780 - denial of service remoto su lighttpd CVE-2022-30780 - denial of service remoto su lighttpd Riepilogo Un attaccante non autenticato può inviare una richiesta HTTP con un URL che supera la lunghezza massima consentita, provocando un denial of service. Versioni vulnerabili Le seguen...

Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

Lighttpd 1.4.34 SQL Injection and Path Traversal

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical...

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

CVE-2026-18754 affects GV-AS1620 Controller Firmware (GV-Cloud). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. The exposed private key can compromise HTTPS confidentiality and integrity, enabling traffic decryption and potential ser...

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18753

CVE-2026-18753 concerns GV-AS1620 Controller Firmware (GV-ASManager). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this private key allows attackers to decrypt HTTPS traffic and spoof the server, compromising confidenti...

CVE-2026-18607

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...

CVE-2026-18607 Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...

EUVD-2026-52371

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...