burpa

burpa: Burp 자동화 도구 Burp Suite 자동화 도구 요구 사항 burp-rest-api Burp Suite Professional slackclient 사용법 root@kitploit: $ python burpa.py -h / / / / / / / / / / / // / // / / / // / // / /./,// / ./,/ // burpa version 0.1 / by 0x4D31 usage: burpa.py -h -a scan,proxy-config,stop -pP PROXYPORT -aP...

CVE2026-42926

CVE-2026-42926 NGINX HTTP/2 フレームインジェクションラボ CVE-2026-42926 に関連する挙動を検証・比較するための、管理されたサイバーセキュリティラボです。この問題は、脆弱なプロキシ構成が使用されている場合に特定の NGINX バージョンへ影響する HTTP/2 フレームインジェクション です。 このリポジトリは、防御的研究、パッチ検証、構成監査、および管理されたラボ環境での再現のみ を目的としています。 分類: HTTP/2 フレームインジェクション 影響を受けるバージョン: NGINX 1.29.4 〜 1.30.0 修正済みバージョン: NGI...

CVE-2022-35914

CVE-2022-35914バッチ検出ツール target.txtファイルを作成し、検出するURLをインポートしてから、バッチ検出を開始できます。 エラーが発生した場合はプロキシを無効にしてください。...

cve-2022-22965

Spring4Shell - CVE-2022-22965 构建 让我们克隆仓库、构建并运行容器 root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22965.git $ cd cve-2022-22965 $ docker build . -t spring4shell-poc $ docker run -p 8080:8080 --name spring4shell-poc spring4shell-poc 使用浏览器检查访问...

EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...

CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

Linux Distros Unpatched Vulnerability : CVE-2026-12547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via...

MAL-2026-10759 Malicious code in ryry-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts und...

EUVD-2026-44823

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175 Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-63175 Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

PYSEC-2026-2597 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

Impact The /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to...

PYSEC-2026-1252 Potential access to sensitive URLs via CKAN extensions (SSRF)

Impact There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the process of reusing a handle for sequential transfers with environment-variable proxy configuration. An attacker can cause sensitive authentication headers to be sent to an...

PYSEC-2026-588

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

CVE-2026-53755 Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through...

PT-2026-50525

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.93.0 Description An authorization bypass exists in the proxy repository configuration. This issue allows a delegated repository administrator to disclose stored upstream proxy credentials...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the proxyconfig.server parameter in the browserconfig or crawlerconfig objects, as well as related proxy settings in extraarg...

PT-2026-50166

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.9 Description The Docker API server fails to apply Server-Side Request Forgery SSRF destination checks to proxy addresses, only validating the crawl target URL. Because the Docker API is unauthenticated by defaul...