CVE-2023-49438

CVE-2023-49438 概念验证 描述 Python 包 Flask-Security-Too =2.1.0 中，autocorrectlocationheader 配置已更改为 False——这意味着重定向中的 Location 头默认是相对的。因此，如果应用程序使用 Werkzeug =2.1.0 作为 WSGI 层，此前未受影响的应用程序可能会受到影响。 缓解措施 1. 更新 Flask-Security-Too 至 5.3.3 root@kitploit: pip install -U Flask-Security-Too 或 2. 在应用中添加以下配置选项（可缓解所有...

CVE-2019-17662

CVE-2019-17662 修改了CVE代码 使用了 Prepared Requests，因为 python3 requests 模块会规范化URL中的 ../，例如： 代码如下： root@kitploit: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode 结果如下： root@kitploit: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close Accept-Encoding: gzip,...

React2Shell-CVE-2025-55182

$$\ $$\ $$$$$$$\ $$\ $$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$$$$\ $$$\ $$$ |$$ $$\ $$$\ $$$ |$$ |$$ | $\ $$ |$$ $$\ $$ | $$$$\ $$$$ |$$ | $$ | $$$$\ $$$$ | $$ | $$ |$$$\ $$ |$$ / $$ | $$ | $$$$$$ $$ |$$$$$$$ | $$$$$$ $$ | $$ | $$ $$ $$$$ |$$ | $$ | $$ | $$ $$$ $$ |$$ $$ $$ $$$ $$ | $$ | $$$$ $$$$ |$$ | $...

ProxyShell

ProxyShell CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability. This faulty URL normalization lets us access an arbitrary backend URL while running as the Exchange Server machine account. Although this bug is not as powerful as the SSRF in ProxyLogon, and w...

CVE-2021-42013

CVE-2021-41773 / CVE-2021-42013 Apache 漏洞扫描器 一个全面的基于 Python 的漏洞扫描器，用于检测 Apache HTTP Server 2.4.49 和 2.4.50 版本中的 CVE-2021-41773 和 CVE-2021-42013 路径遍历及远程代码执行漏洞。 概述 CVE-2021-41773 和 CVE-2021-42013 是影响 Apache HTTP Server 的严重漏洞，允许攻击者： 读取服务器上的任意文件 （路径遍历） 在服务器上执行任意代码 （远程代码执行） 通过不当的 URL 规范化绕过安全限制 这些漏洞在...

livewire-vuln-scanner

Escáner Pasivo de Vulnerabilidades Livewire El Escáner Pasivo de Vulnerabilidades Livewire es una herramienta Python 2.7 diseñada para detectar pasivamente las versiones de Livewire utilizadas por los sitios web e identificar posibles vulnerabilidades basándose en la comparación de versiones. Est...

CVE-2026-74909

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2025-55752

CVE-2025-55752：Apache Tomcat 路径遍历漏洞 基于 Docker 的复现环境，用于重现 Apache Tomcat 10.1.44 中的路径遍历漏洞 CVE-2025-55752。 概述 CVE-2025-55752 是 Apache Tomcat 中 RewriteValve 组件的一个路径遍历漏洞，由于 URL 规范化处理顺序不当导致：URL 规范化发生在 URL 解码之前。这使得攻击者能够使用 URL 编码的路径遍历序列（如 ..%2f）绕过安全约束，访问受保护的目录（如 /WEB-INF/）。 漏洞特性 CVE ID : CVE-2025-55752...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Docker 实验室 PoC 安全通知 该仓库在受控的 Docker 实验室环境中重现了一个已公开披露并已修补的漏洞，仅供教育和研究目的。 该环境故意存在漏洞，且只能在隔离的测试环境中部署。未经明确授权，请勿尝试利用系统。 该项目旨在演示漏洞分析、利用及缓解策略。 路径遍历与远程代码执行 开始使用 root@kitploit: 进入项目文件夹 cd Apache-CVE-2021-41773 验证 compose 语法 docker compose config 启动实验室 docker compose up -d --build...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-54770

In WebOb before 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-r...

CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

CVE-2026-72533

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

EUVD-2026-56003

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

CVE-2026-72533 Portainer Portainer CE - Authentication Bypass

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

GHSA-J839-GQQ4-GF9J Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Summary jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim.indexOf'javascript' === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace/\u0000-\u0020+/g, '' and lowercases the value...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-66825 Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

PYSEC-2026-2405 Bunsink has an SSRF bypass in `validate_webhook_url`

Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be partially bypassed because of a mismatch in URL parsing. In some malformed URLs, Python’s standard URL parser urllib and the HTTP client stack requests / urllib3 do not agree on which host is actually being targeted...