nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

CVE-2020-23592

CVE-2020-23592 OPTILINK E-PON "N.º DE MODELO: OP-XT71000N" con "VERSIÓN DE HARDWARE: V2.2"; y "VERSIÓN DE FIRMWARE: OPV3.3.1-191028" Se encontró una vulnerabilidad en el "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" que permite a un atacante remoto no autentica...

security-research

Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 46 CVEs across 15 projects , 2023 to 2026. Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and...

CVE-2022-42889-Text4Shell-POC

Script de Prueba para CVE-2022-42889 Text4Shell Este repositorio contiene un script de Python para automatizar el proceso de prueba de una vulnerabilidad conocida como Text4Shell, referenciada bajo el CVE id: CVE-2022-42889. Acerca de Text4Shell CVE-2022-42889 Text4Shell es una vulnerabilidad...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

Xstream-1.4.17

Xstream-1.4.17 The above Xstream Demo environment was built by me. The vulnerability exploitation environment is based on JDK1.8u131. It currently supports local testing and HTTP remote packet sending. XSTREAM=1.4.17 vulnerability reproduction CVE-2021-39141, CVE-2021-39144, CVE-2021-39150,...

CVE-2024-10605

Affected Version: BloodBank Management System : 1.0 Vulnerability Information: Vulnerability Type: Cross Site Request Forgery CSRF Severity: HIGH Status: Unpatched Vulnerable Endpoint: Path: file/request.php Vulnerability Description: There is a Cross Site Request Forgery on this endpoint...

CVE-2026-44578

CVE-2026-44578 — SSRF de Actualización WebSocket de Next.js Falsificación de Solicitud del Lado del Servidor sin autenticación en despliegues autoalojados de Next.js. Una única solicitud HTTP manipulada extrae credenciales de AWS, secretos y datos de servicios internos de localhost:80...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 Vulnerabilidad CSRF: Permite Crear Clientes Falsos Nombre del Proyecto y URL del Repositorio :https://phpgurukul.com/client-management-system-using-php-mysql/ Nombre de la Vulnerabilidad : Cross-Site Request Forgery CSRF Versión Afectada : V1.2 Introducción Existe una vulnerabilida...

CVE-2021-26855_SSRF

CVE-2021-26855SSRF CVE-2021-26855 Exchange SSRF POC cambia el token e identificador de ceye.io : token = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' dnsurl = randomstr + '.XXXXXX.ceye.io' python CVE-2021-26855SSRF.py https://a.com...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 SSRF simple exploitation golang practice Affected Versions Exchange Server 2013 earlier than CU23 Exchange Server 2016 earlier than CU18 Exchange Server 2019 earlier than CU7 Exploitation Conditions This vulnerability is different from previous Exchange...

SSRF-Testing

I'm grateful for the support received by Tuta SSRF Server Side Request Forgery testing resources Quick URL based bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Descripción : Explotando un ataque de falsificación de petición en sitios cruzados CSRF para crear un usuario privilegiado a través de la función de añadir usuarios de Webmin y luego obtener una shell inversa a través de la función de procesos en ejecución de...

CVE-2021-21311

CVE-2021-21311 Descripción SSRFServer-side Request Forgery en Adminer herramienta de gestión de bases de datos de código abierto desde v4.0.0 v4.7.8 parcheado en v4.7.9 Commit del parche Uso root@kitploit: exploit.py -h -target TARGET -redirect REDIRECT -host HOST -port PORT options: -h, --help...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 SSRF sin autenticación CVE-2024-48360 | Qualitor = v8.24 SSRF sin autenticación Descripción Qualitor es una plataforma para la gestión de procesos empresariales, y este sistema está presente en varias empresas de Brasil que pueden ser identificadas simplemente...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

LiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery SSRF vulnerability Exposes OpenAI API Keys. id: CVE-2024-6587 info: name: LiteLLM - Server-Side Request Forgery author: pdresearch,iamnoooob,rootxharsh,lambdasawa severity: high description: | LiteLLM vulnerable to Server-Side Request Forgery SSRF...

Radio Player <= 2.0.82 - Server-Side Request Forgery

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations...

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...