CVE-2021-41277

CVE-2021-41277 使用方法 1. ヘルプ情報を表示 /CVE-2021-41277 ❯ go run main.go -h Usage of main: -f string File containing list of targets to verfity -o string File to write output to optional -s Show VulnInfo output -t int Number of concurrent goroutines for resolving default 10 -u string Target to verfity...

SCANNER-INURLBR

새 저장소 검색 엔진의 고급 검색을 통해 GET / POST 캡처 이메일 및 URL을 악용할 수 있는 분석을 제공하며, 각 대상/발견된 URL에 대한 내부 사용자 정의 검증 접합을 포함합니다. https://github.com/MrCl0wnLab/SCANNER-INURLBR...

CVE-2023-42222

CVE-2023-42222 취약점 요약 WebCatalog 버전 48.4.0 이전 버전은 특정 상황에서 URL이 http 또는 https 리소스인지 확인하지 않고 Electron의 shell.openExternal 함수를 호출합니다. 이 취약점으로 인해 공격자는 임의의 프로토콜을 가진 링크가 포함된 메시지를 전송하여 피해자 시스템에서 코드를 실행할 수 있습니다. 피해자는 링크와 상호작용해야 하며, 열리는 URL을 볼 수 있습니다. 취약점 스캔 결과 PoC 개요 PoC 정보 이 취약점은 임의의 URL을 허용하는 페이지를 동기화하...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

Gotenberg < 8.31.0 - Server-Side Request Forgery

Gotenberg before 8.31.0 is vulnerable to server-side request forgery SSRF due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses such as http://::ffff:127.0.0.1 that bypass the...

url-cheatsheet-data

URL検証バイパスチートシートデータ これは PortSwigger URL検証バイパスチートシート を支えるデータです。このデータをGitHubに公開したのは、コミュニティの皆さんにプルリクエストでベクターを追加していただくためです。 コントリビュート コントリビュートするには、JSONデータへの変更を含むプルリクエストを作成してください。 たとえば、domainallowlistbypass.json ファイルに新しいペイロードを追加するには、次のテンプレートを使用します。 "id": "d82a33ae7aa92b0f1f1f5d71a24c0f1197da4e7a",...

SSRF-CVE-2020-15002

概要 /appsuite/api/oxodocumentfilter&action=addfile の処理時に適用されるURL検証ロジックには、Time of Check Time of Use ToCToU SSRF攻撃を実行するために使用できる3つの欠陥があります。この問題により、悪意のある攻撃者は内部ネットワークサービスに対してHTTP GETリクエストを実行でき、保護された情報の漏洩につながる可能性があります。 欠陥 1: Time of Check Time of Use ToCToU 脆弱性 URITools.getFinalURL...

CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : 不適切なURL処理によるローカルファイルインクルージョン（LFI）脆弱性（Real-Browserモニター） 概要 不適切なURL処理の脆弱性 により、攻撃者は file:/// プロトコルを悪用してサーバー上の機密ローカルファイルにアクセスできます。この脆弱性は、"real-browser" リクエストタイプを介して発生します。このリクエストタイプは、攻撃者が指定したURLのスクリーンショットを撮影します。file:///etc/passwd...

CVE-2022-41401

OpenRefine = v3.5.2 SSRF OpenRefine v=3.5.2에는 SSRFServer-Side Request Forgery 취약점이 존재합니다. 이 취약점을 통해 인증되지 않은 사용자가 시스템을 악용하여 내부 리소스에 무단 접근하거나 민감한 파일을 유출할 가능성이 있습니다. 이 취약점의 근본 원인은 OpenRefine이 제공된 URL에 대한 서버 측 검증을 적절히 수행하지 못하기 때문입니다. 클라이언트 측 검증은 존재하지만, 서버 측에서는 동일한 수준의 검증이 이루어지지 않습니다. 결과적으로 사용자가 처음에 유...

CVE-2026-55252 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version...

CVE-2025-21385

SSRF エクスプロイトスクリプト このリポジトリには、テストおよび教育目的でSSRF（サーバーサイドリクエストフォージェリ）エクスプロイトを実行するためのスクリプトが含まれています。このツールは責任を持って、明示的な許可がある環境でのみ使用してください。 機能 ターゲットシステムのSSRF脆弱性を悪用します。 誤用を防ぐため、入力URLを検証します。 明確なエラーメッセージとヘルプメニューを備えた使いやすいCLIインターフェース。 必要条件 bash Unixシェル jq JSONプロセッサ curl HTTPリクエスト用コマンドラインツール 使用方法 構文 ./script.sh...

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-90847

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686

The rhukster dom-sanitizer library (up to version 1.0.15 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the URL Validation component. Specifically, the DOMSanitizer::isDangerousUrl function in src/DOMSanitizer.php can be manipulated to allow malicious scripts. This vulnerability c...

CVE-2026-93903

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

EUVD-2026-89955

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

CVE-2026-93903

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

CVE-2026-93903

LiteSpeed Web Server (LSWS) versions prior to 6.3.7 build 1 are vulnerable to a flaw where the software mishandles internal redirect URL validation during specific "corner case" scenarios. This vulnerability could lead to significant impact as indicated by its CRITICAL severity rating (CVSS 4.0 s...