CVE-2019-11043

PoC CVE-2019-11043 CVE-2019-11043 शोषण का एक पायथन कार्यान्वयन CVE-2019-11043 के रूप में दर्ज शोषण, PHP-FPM के कार्यान्वयन में एक बग का लाभ उठाता है जो NGINX सर्वर के संयोजन में होता है। कुछ विन्यासों में, FastCGI pathinfo में एक नियमित अभिव्यक्ति FPM मॉड्यूल को आवंटित बफ़र्स से परे FastCGI...

CVE-2025-29927-POC

CVE-2025-29927-POC Introduzione Questo repository contiene un Proof of Concept PoC per CVE-2025-29927, una vulnerabilità ipotetica che dimostra un difetto nella gestione del middleware all'interno di un'applicazione web. Il PoC illustra come una richiesta HTTP appositamente modificata possa...

wazuh-nginx-cve-2026-42945-sca-lab

CVE-2026-42945 — Laboratorio Difensivo NGINX Wazuh SCA Panoramica Questo repository documenta un laboratorio difensivo per CVE-2026-42945 , che interessa il modulo NGINX ngxhttprewritemodule. L'obiettivo di questo progetto era affrontare la CVE da una prospettiva blue team utilizzando Wazuh...

nginx-CVE-2017-7529

Vulnerabilità di lettura fuori dai limiti della cache di Nginx CVE-2017-7529 Principio della vulnerabilità Riferimenti: https://cert.360.cn/detailnews.html?id=b879782fbad4a7f773b6c18490d67ac7...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

Razvan Stanga Varnish/Nginx Proxy Caching = 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests. id: CVE-2025-62126 info: name:...

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

PHP-FPM Path Info Buffer Underflow - Remote Code Execution

In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...

Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. id: CVE-2019-18371...

Nginx UI - Broken Access Control

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...

Nginx UI < 2.3.3 - Information Disclosure

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

CVE-2019-11043

Ladon POC Moudle CVE-2019-11043 PHP-FPM + Ngnix Descrizione della vulnerabilità Vulnerabilità di esecuzione remota di codice PHP-FPM CVE-2019-11043 Durante il Real World CTF organizzato da Chaitin Tech, il ricercatore di sicurezza Andrew Danau ha scoperto, mentre risolveva una sfida CTF, che...

CVE-2023-44487

CVE-2023-44487 — Laboratorio di test HTTP/2 Rapid Reset Ambiente didattico per il compito 4 di LTAT.04.022. Quattro container ti permettono di scansionare e confrontare configurazioni vulnerabili e patchate. Mappa delle porte Container| Porta| Software| Stato ---|---|---|--- nginx-vuln| 8441| ngi...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigieren Sie log4shell CVE-2021-44228 und CVE-2021-45046 Schwachstellenangriffe mit einem Nginx LUA-Skript Erfordert das aktivierte Nginx lua-Modul https://www.nginx.com/resources/wiki/modules/lua/. Verwenden Sie include /path/to/mitigate-log4shell.conf; im server...

CVE-2026-42945_NginxRift

🚀 NGINX Rift PoC Automation — CVE-2026-42945 Driver de automação PoC para exploração de RCE do containernginx-rift · Verificação do alvo → Exploit de comando único → Reverse-shell interativa Um único comando orquestra todo o fluxo do exploit — da verificação do container até obter a shell. ⚠️ Avis...

CVE-2019-11043-Docker

Un'immagine Docker con una versione vulnerabile di PHP-FPM CVE-2019-11043 e nginx. Esecuzione docker run --rm -p8080:80 akamajoris/cve-2019-11043 Dovresti poter accedere all'applicazione web all'indirizzo http://your-ip:8080/. Sfruttamento Compila un binario da...

Nginx-CVE-2013-4547

Nginx Logica di Vulnerabilità del Nome File CVE-2013-4547 Descrizione della Vulnerabilità Versioni interessate: Nginx 0.8.41 1.4.3 / 1.5.0 1.5.7 Link di riferimento: https://vulners.com/cve/CVE-2013-4547 https://blog.werner.wiki/file-resolution-vulnerability-nginx/ http://www.91ri.org/9064.html...