CVE-2025-31486-Simulation

Laboratorio Path Traversal di Vite CVE-2025-31486 Un ambiente di laboratorio containerizzato e pratico per simulare e sfruttare la vulnerabilità Path Traversal nel server di sviluppo di Vite, identificata come CVE-2025-31486. 📖 Informazioni sulla Vulnerabilità Questo laboratorio dimostra una...

CVE-2020-8193

CVE-2020-8193...

CVE-2006-3392

CVE-2006-3392 Sulla vulnerabilità È stata segnalata una vulnerabilità in Webmin e Usermin che può essere sfruttata da utenti malintenzionati per divulgare informazioni potenzialmente sensibili. La vulnerabilità è causata da un errore non specificato nella gestione di un URL. Può essere sfruttata...

shiro-cve-2010-3863

Apache Shiro path traversal CVE-2010-3863 Riproduzione della vulnerabilità Setup dell'ambiente locale con docker Apri yakit per catturare i pacchetti payload:/./admin/ Successo...

CVE-2019-19781-Checker

CVE-2019-19781-Checker Verifique se o seu site está vulnerável ao CVE-2019-19781 VISITE https://citrix-checker.com PARA VERIFICAR SE VOCÊ ESTÁ VULNERÁVEL AO CVE-2019-19781 POR FAVOR, USE O NOSSO VERIFICADOR DUAS VEZES PARA TER CERTEZA Este site fornece os resultados se o seu serviço estiver...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 Exploit per l'endpoint SSL VPN GlobalProtect /ssl-vpn/getconfig.esp che aggiunge un payload XSS appositamente creato all'URL. Utilizzo root@kitploit: python3 exploit.py -u https://target.com Parametri -u, --url: URL di base del target non includere i parametri della query...

backdoor.mirai.helloworld

Dasan GPON Router URL ? image quando si aggiunge una stringa dopo...

CVE-2021-42013-EXPLOIT

🚨 CVE-2021-42013 - Apache 2.4.49 e 2.4.50 Esecuzione Remota di Codice 🚨 CVE-2021-42013 si basa sulla vulnerabilità precedentemente identificata, CVE-2021-41773. Nonostante gli sforzi del team di Apache per affrontare CVE-2021-41773 nella versione 2.4.50, indagini successive hanno rivelato che la...

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

Docassemble - Local File Inclusion

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...

PoC-CVE-2025-52913

CVE-2025-52913 - Vulnerabilità di normalizzazione dei percorsi in MiCollab 📌 Panoramica Questo repository contiene una Proof of Concept PoC per CVE-2025-52913 , una vulnerabilità di normalizzazione dei percorsi che interessa Mitel MiCollab. Il problema consente ad attaccanti non autenticati di...

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

EUVD-2026-56784

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

EUVD-2026-54962

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19340 anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

CVE-2026-19337

CVE-2026-19337 affects the package adenot mcp-google-search up to version 0.3.1. The vulnerability is in an unknown function within src/index.ts of the component read_webpage , enabling server-side request forgery (SSRF) through manipulation of the url argument. The attack is described as restric...

keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-16194

CVE-2026-16194 affects zhayujie CowAgent (up to 2.1.1). The issue is in WebFetch.execute (agent/tools/web_fetch/web_fetch.py): manipulating the url parameter can trigger a server-side request forgery. The attack is described as remote; a fix is available in version 2.1.2 (commit ea47f3097eed4f829...