svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

CVE-2021-30862

CVE-2021-30862 In 2021, CodeColorist released his writeups on the Mistuned vulnerabilities, a series of vulnerabilities affecting the iTunes Store allowing for one-click remote code execution. Notably, he demonstrated popping calc with no memory corruption at all, but with just a logic bug. Durin...

CVE-2017-13156

Check-CVE-2017-13156.py root@ubuntu:/CVE-2017-13156$ pip install androguard root@ubuntu:/CVE-2017-13156$ python Check-CVE-2017-13156.py InsecureBankv2.apk Checking if InsecureBankv2.apk is vulnerable to CVE-2017-13156 vulnerability InsecureBankv2.apk md5: 5ee4829065640f9c936ac861d1650ffc...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2017-13156-Janus

CVE-2017-13156-Janus Reproduction Attackers can use the Janus vulnerability CVE-2017-13156 to bypass Android's signature scheme V1 mechanism, arbitrarily modifying application code without affecting its signature. Android's signature mechanism is used to protect applications from tampering...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

CVE-2020-24972

So CVE-2020-24972 spans from another cve in actually. I don't remember the cve that got designated but it has to do with platformpluginpath cmdline option from qt. So in essence the problem comes from using qt, persee the option platformpluginpath . "This parameter is supposed to contain a...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF due to non-functional same-origin checks in justinas/nosurf What happened? Am I affected? PoC Patching Acknowledgements What happened? All versions of nosurf before 1.2.0 failed to apply same-origin checks for incoming requests. This happened due to relying on the .URL.Scheme...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read

The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...

OutlookLeakTest

The Outlook HTML Leak Test Project! Blog post: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ What's in "./Schemes-List.xlsx"? List of URI schemes that might work in Windows. These schemes/protocols can be useful in...

CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...

CVE-2023-24329-lab

CVE-2023-24329 — Parser Differential Lab Educational use only. This lab exists to demonstrate a real vulnerability in a safe, isolated environment. Never run this against systems you do not own. Never reuse the intentionally broken filter code in any production system. A self-contained Docker lab...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Description Context.Scheme unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted headers...

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Summary The c.Scheme method in Echo context.go:162-181 trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the value is http or https. The WWWRedirect and NonWWWRedirect middlewares use this unsanitized scheme to construct redirect URLs,...

CVE-2026-118658

The Echo Go web framework (prior to versions 4.15.2 and 5.1.1 ) is vulnerable to Arbitrary Scheme Injection within the WWWRedirect and NonWWWRedirect middlewares. The root cause is that Context.Scheme retrieves values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme headers without v...

CVE-2026-118658 Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

EUVD-2026-112465

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

CVE-2026-118657

The Echo Go web framework (versions prior to 4.16.0 and 5.4.0 ) is vulnerable to an HTTPS redirect and HSTS bypass because Context.Scheme unconditionally trusts forwarded scheme headers from any client. An attacker can bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP, or suppr...