cve-2023-27163

Thank you to @beet1ehttps://github.com/b33t1e from Shanghai Jiao Tong University and @chenlibo147 , @houqinsheng, [email protected] from Shandong University. Please review https://notes.sjtu.edu.cn/s/MUUhEymt7 for indepth information about the SSRF vulnerability CVE-2023-27163. This code is...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 Exploit Title: Vehicle Service Management System - 'Multiple' Cross-Site Request Forgery CSRF Leads to Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM References:...

CVE-2020-14882

CVE-2020-14882 CVE-2020–14882 - research by Jang Code by @s1kr10s Poc: POST Review / Video: root@kitploit: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf https://www.youtube.com/watch?v=JFVDOIL0YtA&feature=youtu.be...

cve-2019-6715

cve-2019-6715 Shout out to TomNomNom for 99.9% of his code.... Build root@kitploit: go get github.com/fatih/color go build Usage root@kitploit: cat list.txt | ./2019-6715 All vuln urls are logged in text.log CVE 2019-6715 Description: pub/sns.php in the W3 Total Cache plugin before 0.9.4 for...

CVE-2025-55182

CVE-2025-55182 Toolkit & Lab Educational Only Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182. For educational and authorized testing only. Features Root-cause writeup, visuals, and lab: see React2ShellDeconstructingaPerfect10RCE.pdf and the attack-path...

CVE-2019-19781-poc

CVE-2019-19781-poc Modified PoC, suitable for Python3 python3 CVE-2019-19781.py http://example.com...

CVE-2025-63700

CVE-2025-63700 OAuth Authentication Bypass in Clerk-js 5.88.0 Affected Product Vendor : Clerk Inc. clerk.dev / clerk.com Product : Clerk-js @clerk/clerk-js Affected Version : 5.88.0 Impact : OAuth Authentication Bypass CWE-290 : Authentication Bypass by Spoofing Bug Author Hasnat Ibrahim Nishat -...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

CVE-2023-3722

CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device Services Unrestricted File Upload RCE. This script will use a PUT request to upload a php file with an eight-digit randomly generated filename. Then it will make a GET request to retrieve this file and parse the output to get the comman...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-93661

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...

CVE-2022-22536_SAP_Request_Smuggling_Scanner

CVE-2022-22536 SAP Rquest Smuggling Scanner This is a fast, socket-level batch scanner for CVE-2022-22536 , a critical request smuggling vulnerability in SAP Internet Communication Manager ICM and SAP Web Dispatcher. It tests multiple hosts in parallel for protocol desynchronization behavior...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. id: CVE-2018-1000600...

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

CVE-2026-92530

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...