Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Descripción CVE-2026-49975, también conocida como HTTP/2 Bomb , es una vulnerabilidad de denegación de servicio DoS remoto que afecta a la mayoría de los servidores web principales en su configuración HTTP/2 predeterminada. La vulnerabilidad fue...

CVE-2023-44487-HTTP-2-Rapid-Reset-Attack

PoC - CVE-2023-44487: HTTP/2 快速重置攻击 该仓库包含一个概念验证（PoC）代码，用于演示利用漏洞 CVE-2023-44487 （也称为 HTTP/2 Rapid Reset Attack ）。该漏洞影响 HTTP/2 协议，攻击者可通过快速关闭 RSTSTREAM 的流（streams）来使 web 服务器过载。 📌 描述 CVE-2023-44487 是 HTTP/2 协议中的一个漏洞，允许攻击者发动大规模分布式拒绝服务（DDoS）攻击。该攻击通过在单个 HTTP/2 连接内打开多个流，然后使用 RSTSTREAM...

HTTP-Basma

Adaptive Fingerprinting: HTTP-Basma's Multi-Stage Probing for Granular Server Differentiation HTTP-Basma is live at https://httpbasma.netomize.ca/ Introduction In the realm of cybersecurity, accurately identifying and characterizing web servers is crucial for threat detection, vulnerability...

CVE-2022-44877

CVE-2022-44877 概述 此 bash 脚本用于测试 Web 服务器对 CVE-2022-44877 漏洞的脆弱性。该脚本使用以 base64 编码的载荷向目标 URL 发起 curl 请求。如果目标存在 CVE-2022-44877 漏洞，则 curl 请求的耗时将大于 3.5 秒。 安装 root@kitploit: sudo apt-get update sudo apt-get install curl bc git clone https://github.com/Chocapikk/CVE-2022-44877 cd CVE-2022-44877 chmod +x...

vulmap

🌟 Vulmap - Web vulnerability scanning and verification tools Click here for the English Version Vulmap is a web vulnerability scanning and verification tool. It can scan and exploit vulnerabilities in webapps. Currently supported webapps include activemq, flink, shiro, solr, struts2, tomcat, unom...

cookiescanner

cookiescanner 用于检查多个站点中 cookie 标记的工具。 简介 该工具旨在简化当我们分析多个 Web 服务器时检查 cookie 标记的过程。 想知道为什么这个工具可能有用吗？ https://www.owasp.org/index.php/SecureFlag https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/Testingforcookiesattributes%28OTG-SESS-002%29 用法 root@kitploit: 用法: cookiescanner.p...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Descripción Este repositorio contiene código de prueba de concepto PoC para la vulnerabilidad HTTP/2 Rapid Reset identificada como CVE-2023-44487. Resumen de la vulnerabilidad ID de CVE : CVE-2023-44487 Impacto : Denegación de servicio DoS Protocolos afectados :...

CVE_2023_44487-Rapid_Reset

Herramienta de Prueba de Rapid Reset HTTP/2 CVE-2023-44487 - Edición Mejorada Una herramienta integral de pruebas en Python para CVE-2023-44487 , la vulnerabilidad de Rapid Reset en HTTP/2. Esta versión mejorada proporciona control granular sobre los parámetros de prueba, múltiples patrones de...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Descrizione Questo repository contiene il codice proof-of-concept PoC per la vulnerabilità HTTP/2 Rapid Reset identificata come CVE-2023-44487. Panoramica della vulnerabilità ID CVE : CVE-2023-44487 Impatto : Denial of Service DoS Protocolli interessati : HTTP/2...

EUVD-2024-55705

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

CVE-2026-60364

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2026-60365

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

PT-2026-62459

Name of the Vulnerable Software and Affected Versions Oracle Weblogic Server Proxy Plug-in version 15.1.1.0.0 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Weblogic Server Proxy Plug-in. This issue allows for the unauthorized creation, deletion, or...

PYSEC-2026-1617 Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Description The Model Context Protocol MCP Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured...

The vulnerability of the modular interface between web servers and web applications in Rack, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the modular interface between web servers and Rack web applications is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20260609-73-0009

The vulnerability of the ngxhttpsslmodule module in NGINX Plus and NGINX Open Source web servers is related to the use of memory after deallocation. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and accessibility of protected information...

ROS-20260609-73-0014

The vulnerability of the ngxhttprewritemodule module in NGINX Plus and NGINX Open Source web servers is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...