Prestashop-CVE-2024-34716

Script de Explotación para Ataque CSRF y Reverse Shell Este script automatiza un exploit de CSRF Falsificación de Petición en Sitios Cruzados para cargar un reverse shell PHP en el servidor web de un objetivo y ejecutarlo. El reverse shell se entrega como un archivo ZIP mediante un payload CSRF...

CVE-2026-64849-poc-lab

Security Lab — SSRF Exploitation in MLflow Webhooks CVE-2026-64849 · MLflow Restricted use: lab material, only for authorized networks and environments. See Legal notice. 1. Executive summary Attribute| Value ---|--- Vulnerability| CVE-2026-64849 — SSRF via Webhook Redirect Bypass Affected...

CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF Vulnerability Summary Critical state-changing actions in the Axigen WebAdmin interface are accessible via GET requests. While the h token protects against direct CSRF, the application processes queued requests via the s breadcrumb parameter immediately after a...

CVE-2023-38434

CVE-2023-38434 xHTTP commit 72f812d y versiones anteriores sufren de una vulnerabilidad de doble liberación en closeconnection en xhttp.c, línea 595. ifconn-request.public.headers.list != NULL freeconn-request.public.headers.list; Para confirmar la vulnerabilidad, compile el servidor xHTTP inclui...

EUVD-2026-92107

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

live-server-evil-crawler

Live Server Evil Crawler Un sitio de GitHub Pages para demostrar la vulnerabilidad de la extensión Live Server de VSCode CVE-2025-65717. Resumen Esta herramienta demuestra una vulnerabilidad donde Live Server permite solicitudes desde cualquier origen, lo que permite que páginas web maliciosas...

CVE-2023-28432

Explotación de vulnerabilidad en MinIO CVE-2023-28432 Descripción Este script en python3 está diseñado para explotar CVE-2023-28432, que potencialmente afecta a ciertas configuraciones del servidor MinIO. El script realiza una solicitud POST a un hostname especificado, intentando recuperar...

CVE-2022-4896

CVE-2022-4896 PoC y exploits para CVE-2022-4896 "Control de Ciber" es un software de gestión de cibercafés. Múltiples vulnerabilidades de Denegación de Servicio DoS en versiones anteriores a la 1.650. Un atacante remoto no autenticado puede enviar una solicitud cuidadosamente diseñada que provoca...

CVE-2026-105148 SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery

A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generationconfig.apibase leads to server-side request forgery. The...

CVE-2017-7529

CVE-2017-7529 Description Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. Source:...

CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ Uso exclusivo para fines educativos y entornos autorizados. PoC funcional para la vulnerabilidad CVE-2022-47447, que afecta a un plugin de WordPress vulnerable, permitiendo un ataque de tipo Cross-Site Request Forgery CSRF contra usuarios autenticados...

CVE-2025-10377

Proof of Concept CVE-2025-10377 Cross-Site Request Forgery CSRF in Plugin System Dashboard Funtion sdtogglelogs Vulnerability Type: Cross-Site Request Forgery CSRF Affected Function: sdtogglelogs CVSS v3.1: 4.3 Medium Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Note: Score reflects unauthorized...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd RCE Descripción de la vulnerabilidad Vulnerabilidad de ejecución remota de código en Nostromo nhttpd versiones 2&1 Uso python3 cve-2019-16278.py Ejemplo: python3 cve-2019-16278.py 192.168.1.100 80 "id" python3 cve-2019-16278.py 10.10.10.10 8080 "cat /etc/passwd"...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...

CVE-2023-27163-lab

CVE-2023-27163 — Request-Baskets SSRF Lab Project: Vulnerability Research & Reproduction Lab — CVE-2023-27163 Author: Amulya Kaushik Role: Cybersecurity R&D & Lab Content Development Intern Candidate Server-Side Request Forgery in Request-Baskets ≤ 1.2.1 A self-contained local research lab for...

CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

CVE-2025-0108-Authentication-Bypass-checker

Esta herramienta comprueba si un dispositivo PAN-OS objetivo es vulnerable a la vulnerabilidad de omisión de autenticación CVE-2025-0108. Envía una solicitud HTTP manipulada al objetivo y analiza la respuesta para determinar si el dispositivo es explotable. Uso IP única python...

SSRF-Testing

I'm grateful for the support received by Tuta SSRF Server Side Request Forgery testing resources Quick URL based bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

CVE-2019-1332

CVE-2019-1332: Reflected Cross-Site Scripting in Microsoft SQL Server Reporting Services A cross-site scripting XSS vulnerability exists when Microsoft SQL Server Reporting Services SSRS does not properly sanitize a specially-crafted web request to an affected SSRS server. An attacker who...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...