ProxyLogon-CVE-2021-26855-metasploit

ProxyLogon-CVE-2021-26855-metasploit CVE-2021-26855 proxyLogon Exchange SSRF到任意文件写入的metasploit漏洞利用脚本 准备 root@kitploit: git clone https://github.com/TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit cd ProxyLogon-CVE-2021-26855-metasploit mkdir -p /.msf4/modules/exploits/windows/ cp...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF 漏洞 📌 概述 CVE-2026-44578 是一个影响自托管 Next.js 应用的高严重性 服务端请求伪造 SSRF 漏洞。 攻击者可以利用精心构造的 WebSocket 升级请求 ，强制服务器向内部或外部系统发起出站请求。 ⚠️ 影响 此漏洞可能允许攻击者访问： 目标| 风险 ---|--- 🔐 内部 API| 未授权的内部访问 ☁️ 云元数据端点| 凭证泄露 🖥 管理接口| 权限提升 🌐 网络资源| 内部侦察 🧠 攻击流程 root@kitploit: Attacker │ ▼ Crafted WebSocket...

CVE-2026-71172

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

Web-Security-Learning

Web-Security-Learning Indirizzo del progetto: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Attacco e difesa delle vulnerabilità: https://t.zsxq.com/mm2zBeq Indice: Web-Security-Learning Web Security SQL injection MySql MSSQL PostgreSQL MongoDB Tecniche Strumenti XSS CSRF Altr...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF إلى RCE في إضافة WordPress Custom CSS, JS & PHP الإصدار = 2.4.1 🧠 الوصف ثغرة Cross-Site Request Forgery CSRF في إضافة WPFactory Custom CSS, JS & PHP تسمح بـ تنفيذ التعليمات البرمجية عن بُعد RCE عن طريق حقن كود PHP خبيث عبر طلبات POST غير مصرح بها. يؤثر هذا على جميع الإصدار...

CVE-2025-31033

⚠️ CVE-2025-31033 - WordPress Buddypress Humanity प्लगइन में CSRF = 1.2 🛡️ भेद्यता सारांश WordPress के लिए Buddypress Humanity प्लगइन संस्करण = 1.2 क्रॉस-साइट रिक्वेस्ट फोर्जरी CSRF के लिए कमजोर है। यह कमजोरी एक हमलावर को उच्च विशेषाधिकार वाले उपयोगकर्ता जैसे, एडमिन को अनजाने में प्लगइन सेटिंग्स...

CVE-2021-31760

..| CVE-2021-31760 |.. Descrizione : Sfruttare un attacco Cross-site request forgery CSRF per ottenere una Remote Command Execution RCE attraverso la funzione di processo in esecuzione di Webmin Versione testata : Webmin 1.973 ultima versione su GitHub 07/03/2021 Tipo di attacco: Remoto Impatto :...

VMWare-vRealize-SSRF

VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 UTILIZZO python CVE-2021-21975.py...

CVE-2026-80350

OneUptime before version 12.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery path. The host-literal screening in Common/Server/Utils/SSRFProtection.ts (function isBlockedHostnameLiteral) rejects private and loopback IPv4 addresses and a limited set of IPv6 f...

CVE-2026-80347

mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange anfällig für Server-Side Request Forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Scrittura Arbitraria di File a RCE – Processo di Derivazione del PoC e Riflessioni Ambito di applicazione: solo per laboratori locali, ambienti autorizzati di riproduzione, verifica di vulnerabilità e analisi di regole di protezione. Non...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Erstellt von TheAlchimist root@kitploit: cve-2023-27163-ssrfbaskets.py Beispiel : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

SSRF-CVE-2023-22493

is: SSRF-CVE-2023-22493 Analyse von CVE-2023-22493 SSRF-CVE-2023-22493 Analyse von CVE-2023-22493...

CVE-2026-15409

🚨 CVE-2026-15409 SSRF critico non autenticato in SonicWall SMA1000 Series Vulnerabilità critica di Server-Side Request Forgery SSRF che interessa i dispositivi della serie SonicWall SMA1000. Questo repository documenta la vulnerabilità, i prodotti interessati, una panoramica tecnica, l'impatto, l...

Prestashop-CVE-2024-34716

Script di Exploit per Attacco CSRF e Reverse Shell Questo script automatizza un exploit CSRF Cross-Site Request Forgery per caricare una reverse shell PHP sul web server di un target ed eseguirla. La reverse shell viene fornita come file ZIP tramite un payload CSRF appositamente creato, che viene...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF zu LFI Exploit ⚠️ HAFTUNGSAUSSCHLUSS DIESES WERKZEUG IST NUR FÜR BILDUNGSZWECKE UND AUTORISIERTE SICHERHEITSTESTS GEEIGNET Dieser Proof-of-Concept-Exploit wird zu Bildungszwecken bereitgestellt, um Sicherheitsexperten zu helfen, die Schwachstelle zu...

CVE-2022-46364-htb-ctf

Strumento di Sfruttamento SOAP per DevArea CVE-2022-46364 Descrizione Questo exploit specializzato ha come bersaglio l'ambiente DevArea su Hack The Box. Sfrutta una vulnerabilità critica in Apache CXF 3.2.14 CVE-2022-46364 per eseguire Local File Inclusion LFI e Server-Side Request Forgery SSRF. ...