Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic Unauthorized bypass RCE CVE-2020-14882 Oracle Weblogic Unauthorized bypass RCE test script it works on Python3 Requests POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Geck...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device. The vulnerability primarily stems from...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi patch bypass For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate CVE-2021-42013 , present in Apache HTTP Server 2.4.50. This CVE is the bypass of the patch...

CVE-2021-41773

CVE-2021-41773 Apache httpd only 2.4.49 For educational purposes only. See Reference for the details. Run $ git clone https://github.com/masahiro331/CVE-2021-41773.git $ cd CVE-2021-41773 $ docker build -t cve-2021-41773 . $ docker run -d -p 8080:80 cve-2021-41773 Exploit This vulnerability affec...

Astra Linux – Vulnerability in Apache2

A encoding problem in the modproxy component of the Apache HTTP Server 2.4.59 and earlier versions allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication through crafted requests. Users are recommended to upgrade to version 2.4.60, which...

CVE-2026-100409: Improper Handling of URL Encoding (Hex Encoding)

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130145 advisory. Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue...

BIT-GHOST-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

PT-2026-109137

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

CVE-2026-103276

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

CVE-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

CVE-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

CVE-2026-103276

Ghost versions before 6.20.0 are vulnerable to a file extension filtering bypass that allows unauthenticated attackers to read theme templates and metadata . The root cause is an insufficient validation of file extensions, which can be circumvented using URL encoding . This allows unauthorized ac...

CVE-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Bypass de Autenticación en Openfire Este repositorio destaca un problema de seguridad grave que afecta a varias versiones de Openfire. Openfire, un servidor de colaboración en tiempo real multiplataforma que utiliza el protocolo XMPP desarrollado por la comunidad Ignite Realtime,...

CVE-2026-103276: Improper Handling of Alternate Encoding

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

PT-2026-103808

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.20.0 Description An issue exists where unauthenticated attackers can read theme templates and metadata. This is possible through a file extension filtering bypass, where attackers utilize URL encoding to circumvent...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1784625369)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784625369 advisory. - Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some...