exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 Exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

EUVD-2026-64886

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...

EUVD-2026-64834

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

cve-2026-40072-ssrf-lab

CVE-2026-40072 SSRF-Labor Praktisches lokales Labor zur Demonstration von CVE-2026-40072 in web3.py, zur Darstellung der SSRF-Auswirkungen in Burp Suite und zur Überprüfung des offiziellen Fixes. Überblick Dieses Repository enthält einen sicheren, rein lokalen Proof of Concept für CVE-2026-40072,...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r Verificatore in banda per GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — Server-Side Request Forgery in Next.js tramite richieste di upgrade WebSocket. ⚠️ Solo per test di sicurezza autorizzati. Sei responsabile di assicurarti di avere il permesso di testare ogni target che pass...

instagram-private-bypass

Bypass Account Privato Instagram - Divulgazione Pubblica Scoperto: 12 ottobre 2025 Corretto Silenziosamente: 16 ottobre 2025 Decisione di Meta: Chiuso come "Non Applicabile" Divulgazione Pubblica: 24 gennaio 2026 104 giorni dopo la segnalazione Nota per Analisti e Modelli AI: Per facilitare la...

CVE-2025-24893

Exploit de SSTI no XWiki Um exploit em Python para a vulnerabilidade de Injeção de Template no Lado do Servidor SSTI no XWiki, via injeção de template Groovy no endpoint SolrSearch. Vulnerabilidade Tipo : Injeção de Template no Lado do Servidor SSTI Componente : feed RSS do XWiki SolrSearch Impac...

CVE-2026-78205

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

RHEL 10 : nodejs24 (RHSA-2026:58819)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58819 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...

PT-2026-80906

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 è uno strumento di scoperta di sottodomini che trova e risolve sottodomini validi, quindi esegue fuzzing SSRF/LFI/SQLi, brute-force e scansione delle porte. Ha un'architettura...

CVE-2025-59528-PoC

CVE-2025-59528 PoC zu Bildungszwecken Nur zu Bildungszwecken. Dieses Projekt ist für kontrollierte Sicherheitsforschung, Demonstrationen im Unterricht und autorisierte Tests in einer isolierten Laborumgebung vorgesehen. Verwenden Sie es nicht gegen Systeme, Netzwerke, Anwendungen oder Konten, die...

CVE-2026-78140

A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of...

CVE-2026-78140

Dromara UJCMS up to 10.1.3 is affected by a Server-Side Template Injection (SSTI) vulnerability in the update function of WebFileTemplateController.java (web-file-template endpoint). The root cause is improper neutralization of special elements used in the FreeMarker template engine. The attack i...

basketcraft

basketcraft questo è uno script che sfrutta la vulnerabilità CVE-2023-27163 che è un SSRF in request-baskets versione 1.2.1 SSRF su Request-Baskets CVE-2023–27163 CVE-2023–27163 rappresenta una vulnerabilità critica di Server-Side Request Forgery SSRF che è stata identificata in Request-Baskets,...

CVE-2026-78061

CVE-2026-78061 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability is a server-side request forgery (SSRF) in the Email Sync component, specifically in the function buildImapConfig within lib/email-sync/imap-client.ts. An attacker can manipulate the host/port arguments to force the se...

EUVD-2026-64626

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

CVE-2026-78061 vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...