CVE-2023-49438

CVE-2023-49438 Proof of Concept Description An open redirect vulnerability in the python package Flask-Security-Too =version 5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes. Background...

CVE-2019-17662

CVE-2019-17662 Modified the CVE code Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as: For code: root@kitploit: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode Results in: root@kitploit: GET /test HTTP/1.1 Host:...

ProxyShell

ProxyShell（CVE-2021-34473） CVE-2021-34473 Microsoft Exchange Server 远程代码执行漏洞。 这种错误的 URL 规范化机制允许我们以 Exchange Server 计算机账户身份访问任意后端 URL。尽管此漏洞的威力不如 ProxyLogon 中的 SSRF，并且我们只能操纵 URL 的路径部分，但它仍然足以让我们在任意后端访问的基础上实施进一步攻击。 CVE-2021-34523 - Exchange PowerShell 后端权限提升 CVE-2021-31207 - 认证后任意文件写入 Scanner 用于...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability A Docker-based reproduction environment to reproduce the path traversal vulnerability CVE-2025-55752 in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in the RewriteValve component of Apache Tomcat, cause...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Lab Docker PoC Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

React2Shell-CVE-2025-55182

root@kitploit: $$\ $$\ $$$$$$$\ $$\ $$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$$$$\ $$$\ $$$ |$$ $$\ $$$\ $$$ |$$ |$$ | $\ $$ |$$ $$\ $$ | $$$$\ $$$$ |$$ | $$ | $$$$\ $$$$ | $$ | $$ |$$$\ $$ |$$ / $$ | $$ | $$$$$$ $$ |$$$$$$$ | $$$$$$ $$ | $$ | $$ $$ $$$$ |$$ | $$ | $$ | $$ $$$ $$ |$$ $$ $$ $$$ $$ |...

CVE-2021-42013

CVE-2021-41773 / CVE-2021-42013 Apache Vulnerability Scanner A comprehensive Python-based vulnerability scanner for detecting CVE-2021-41773 and CVE-2021-42013 path traversal and remote code execution vulnerabilities in Apache HTTP Server versions 2.4.49 and 2.4.50. Overview CVE-2021-41773 and...

livewire-vuln-scanner

Livewire Passive Vulnerability Scanner Livewire Passive Vulnerability Scanner is a Python 2.7 tool designed to passively detect Livewire versions used by websites and identify potential vulnerabilities based on version comparison. This scanner does not exploit any vulnerability. It only analyzes...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-54770

In WebOb before 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-r...

CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

CVE-2026-72533

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

EUVD-2026-56003

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-72533 Portainer Portainer CE - Authentication Bypass

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

GHSA-J839-GQQ4-GF9J Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Summary jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim.indexOf'javascript' === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace/\u0000-\u0020+/g, '' and lowercases the value...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

PYSEC-2026-2405 Bunsink has an SSRF bypass in `validate_webhook_url`

Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be partially bypassed because of a mismatch in URL parsing. In some malformed URLs, Python’s standard URL parser urllib and the HTTP client stack requests / urllib3 do not agree on which host is actually being targeted...

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...