EUVD-2026-125521

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...

CVE-2026-63150

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...

poc_proxylogon

pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-26855 This is script was originaly made by celesian to exploit this CVE. Then i updated it to exploit an exchange server vulnerable to SSRF but it got a Shell exploiting the EWS feature, because a client company patched it's exchange server...

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork：app:"Microsoft Exchange Server" Using the script MicrosoftExchangeServerSSRFCVE-2021-26855.py written with Seebug toolkit and pocsuite3, to probe data from the past year: 成功率约为：1500 / 5000 = 30%...

CVE-2024-34958

CVE-2024-34957 idccms CSRF poc CVE-2024-34958 idccms CSRF poc...

cve-2016-4845_csrf

cve-2016-4845csrf Proof of concept for CSRF vulnerabilityCVE-2016-4825 on IO-DATA Recording Hard Disc Drive. License These codes are released under the MIT License. Please see LICENSE.txt...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...

CVE-2021-27905

CVE-2021-27905 Apache Solr ReplicationHandler Server Side Request Forgery SSRF Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and clien...

ProxyLogon-CVE-2021-26855-metasploit

ProxyLogon-CVE-2021-26855-metasploit CVE-2021-26855 proxyLogon exchange ssrf to arbitrary file write metasploit exploit script preparation git clone https://github.com/TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit cd ProxyLogon-CVE-2021-26855-metasploit mkdir -p...

WebLogic-SSRF_CVE-2014-4210

WebLogic-SSRFCVE-2014-4210 Weblogic SearchPublicRegistries SSRFCVE-2014-4210 Exploit Script based on Python3 Usage optional arguments: -h, --help show this help message and exit -u U Single Target URL -uf UF Read URLs from file -p P Only scan specified ports -sn SN Only scan specified subnets -sf...

Xstream-1.4.17

Xstream-1.4.17 The above Xstream Demo environment was built by me. The vulnerability exploitation environment is based on JDK1.8u131. It currently supports local testing and HTTP remote packet sending. XSTREAM=1.4.17 vulnerability reproduction CVE-2021-39141, CVE-2021-39144, CVE-2021-39150,...

CVE-2025-55182-exploit

⚠️ DISCLAIMER This tool is for authorized security testing and educational purposes ONLY. Only test systems you own or have explicit written permission to test Unauthorized use is illegal and unethical The developers assume no liability for misuse Use responsibly and in compliance with all...

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can...

CVE-2026-128043

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

CVE-2026-127093

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routingoverride.url to POST /api/integrations/id/test. Attackers can target loopback, private-network and cloud...

CVE-2026-126485

OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values,...

CVE-2021-26855_SSRF

CVE-2021-26855SSRF CVE-2021-26855 Exchange SSRF POC change the ceye.io tokne & Identifier : token = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' dnsurl = randomstr + '.XXXXXX.ceye.io' python CVE-2021-26855SSRF.py https://a.com...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Exploit toolchain XSS CSRF RCE PacketStorm WLB-2020080010 Disclaimer: this exploit toolchain was inspired by EDB-ID 20009. Goal The goal of this exploit toolchain is to replace EDB-ID 20009. Pros of this toolchain over EDB-ID 20009 exploit: Simple to use Reusab...

EUVD-2026-125237

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NCALLOWLOCALHOOKS or NCWEBHOOKALLOWPRIVATENETWORK is set, attackers can request...

EUVD-2026-125197

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET...