23 matches found
CVE-2004-0789-DDOS
root@kitploit: sudo python3 exploit.py Enter the DNS server IP address: IP Enter the number of requests to send: NUMBER...
CVE-2023-44487-
CVE-2023-44487- 1- Install Go. 2- Run the server on one seperate machine server.go file 3- Execute the main.go file on a separate machine. Note: main.go contains the attack code. 4. Specify the IP address of the target. 5- Define the number of requests: run main.go -requests 5000...
CVE-2025-31650
Apache Tomcat 10.1.39 - Denial of Service DoS This tool performs a high-volume, asynchronous HTTP/2 request flood using malformed priority headers to test the stability of Apache Tomcat servers running version 10.1.10 to 10.1.39. ⚠️ This is strictly for educational and research purposes only. ❌ Th...
CVE-2023-22622
DoS WP-Cron - CVE-2023-22622 Exploit PoC Overview This repository contains a script that exploits the CVE-2023-22622 vulnerability in WordPress, causing a Denial of Service DoS via WP-Cron. This script can be used to flood a vulnerable WordPress site with requests, potentially leading to server...
CVE-2026-86452
MISP versions ≤2.5.45 are affected by a vulnerability in unauthenticated mail endpoints, specifically the forgot password-reset and API-access request paths. The root cause is the absence of input length bounds, format validation, and rate limiting on these anonymous request paths, allowing an at...
CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...
HttpStrike
HttpStrike A fast DDoS script written in Python, it will send a lot of get requests if you increase the requests however you please...
AZL-99384 CVE-2026-78662 affecting package telegraf 1.31.0-31
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
EUVD-2026-70266
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
DEBIAN-CVE-2026-23934
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...
EUVD-2026-38171
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/ endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid...
CVE-2026-29606
OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...
EUVD-2024-45395
Malicious code in bioql PyPI...
CVE-2020-9487
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...
CVE-2025-2586
A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk...
Informatica: No rate limiting on form[register]
The vulnerability overview is as follows: There was a lack of rate limiting on the formregister endpoint, allowing an attacker to send a large number of requests to the server in rapid succession without any restrictions. This could potentially have led to accelerated service usage and resource...
DNS Servers Request Flooding Denial of Service
Remote attackers may rapidly send a large number of DNS requests to the server within a short period of time. Successful exploitation may cause the server to crash, resulting in a denial of service condition...
Automattic: Captcha bypass for the most important function - At en.instagram-brand.com
Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...
