CVE-2022-1386

Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of Concept Request: POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...

ProxyLogon

ProxyLogon For Python3 ProxyLogonCVE-2021-26855+CVE-2021-27065 Exchange Server RCESSRF-GetWebShell usage: python ProxyLogon.py --host=exchange.com [email protected] python ProxyLogon.py --host=exchange.com --mails=./mails.txt args: --host: target's address. --mail: exists user's mail. --mail...

grafana-ssrf

grafana-ssrf Authenticated SSRF in Grafana. Notes Azure metadata header has been added to all SSRFS Google metadata header has been added to all SSRFS SSRF will not follow redirects no matter what so ensure url is direct. If login is via SSO or other none grafana logins please grab your session...

CVE-2025-4123-Exploit-Tool-Grafana-

CVE-2025-4123 - Grafana Path Traversal Exploit Developed by mitsec This is a proof-of-concept PoC exploit tool for CVE-2025-4123 , a critical path traversal vulnerability in Grafana's /public endpoint. The exploit allows for: ✅ Server-Side Request Forgery SSRF ✅ Local File Inclusion LFI ✅ Open...

CVE-2023-27163

CVE-2023-27163 This is a PoC for CVE-2023-27163 which is a SSRF vulnerability present in request-baskets upto v1.2.1. This vulnerability allows attackers to access sensitive network resources via /api/baskets/name. The request-baskets contains a functionality where a user can specify another serv...

My-CVEs

A list of vulnerabilities I found. Some vulnerabilities come with deep technical writeups, exploits or even fuzzing session walkthroughs. Some vulnerabilities don't have CVEs because maintainers ghosted me, or because a maintainer didn't agree it's a security bug, I decided to release those as...

forgejo-hostmatcher-0001-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-hostmatcher-0001-ssrf forgejo-hostmatcher-0001-ssrf Class: SSRF Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo Default webhook ALLOWEDHOSTLIST is empty, so services/webhook/deliver.go builds the client with...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

wonderplugin

Wonderplugin For RCE DONT USE THIS FAKE PLUGIN ON YOUR PRODUCTION WEB SERVER! This repository purposed for test a vulnerability on wonderCMS, this fake plugin contain backdoor web shell, you can find it on evil.php file. Related Article WonderCMS 3.1.3 - Authenticated RCE & Blind SSRF Vulnerabili...

CVE-2026-42141-xibo-ssrf

CVE-2026-42141 - XIBO CMS SSRF SSRF vulnerability in Xibo CMS CVE-2026-42141 Description Server-Side Request Forgery SSRF vulnerability in Xibo CMS via the uploadUrl feature. This vulnerability was discovered during security research on Xibo CMS. Impact An authenticated user can force the server ...

CVE-2023-27163

CVE-2023-27163 Request-Baskets v1.2.1 - Server-side request forgery SSRF request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/baskets/name. This vulnerability allows attackers to access network resources and sensitive information via a...

datapower-redis-rce-exploit

datapower-redis-rce-exploit CVE-2020-5014 A POC for IBM DataPower Authenticated Redis RCE Exploit abusing the "Test Message" Function. Full explination and demo on Youtube Blog post on tomcope.com Explanation Using the DataPower "Send a Test Message" function available through a authenticated...

gitlab-gitaly-fetch-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitlab-gitaly-fetch-ssrf gitlab-gitaly-fetch-ssrf GitLab CE 19.4.1 - GitLab Inc. GitHub Enterprise / Bitbucket Server import and Direct Transfer, when that flag is on skip Projects::ImportServicegetresolvedaddress...

grafana-gitsync-dns-rebind

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · grafana-gitsync-dns-rebind grafana-gitsync-dns-rebind Class: SSRF Reach: Remote Grafana OSS 13.2.3 6193dc0 - Grafana Labs Git Sync URLValidator checks the repository URL host at admission. nanogit / Test re-resolve...

kube-alien

Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...

PoC-CVE-2025-26529

PoC for CVE-2025-26529 – Moodle XSS to RCE Exploit This is a Proof of Concept PoC demonstrating the SSRF to XSS → XSS to RCE vulnerability chain in Moodle. Overview I’ve uploaded all the necessary files to demonstrate the full chain of exploitation: 1. SSRF to XSS 2. Grabbing the admin cookie 3...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2026-42281

CVE-2026-42281: MagicMirror² ≤ 2.35.0 - Unauthenticated SSRF via /cors endpoint Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/magicmirror-ssrf-cve-2026-42281/ Upstream advisory: MagicMirrorOrg/MagicMirror security advisories NVD entry:...

CVE-2021-22214

CVE-2021-22214 GitLab CI Lint API Unauthorized SSRF Vulnerability CVE-2021-22214 This article and the tool are for technical sharing only. Strictly prohibited for illegal use, otherwise all consequences shall be borne by the user. Usage help $ python3 gitlabssrf.py...

CVE-2026-50131

CVE-2026-50131 Fedify incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allowed special-use IPv4 ranges. Primary advisory: GHSA-xw9q-2mv6-9fr8 Official CVE record: CVE-2026-50131 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-50131 GHSA|...