Lucene search
+L

106 matches found

Kitploit
Kitploit
added 2026/08/27 5:20 p.m.2 views

verify-ghsa-c4j6-fc7j-m34r

التحقق من GHSA-c4j6-fc7j-m34r أداة تحقق داخل النطاق in-band verifier لـ GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — تزوير الطلبات من جانب الخادم SSRF في Next.js عبر طلبات ترقية WebSocket. ⚠️ للاستخدام المصرح به في الاختبارات الأمنية فقط. أنت وحدك المسؤول عن التأكد من أن لديك الإذن لاختبار كل هدف تمرره...

8.6CVSS8AI score0.38872EPSS
SaveExploits10References4
Kitploit
Kitploit
added 2026/08/27 3:24 a.m.3 views

CVE-2026-44578

CVE-2026-44578 — Next.js वेबसॉकेट अपग्रेड SSRF Next.js स्व-होस्टेड डिप्लॉयमेंट में प्री-ऑथेंटिकेशन सर्वर-साइड रिक्वेस्ट फॉरजरी। एक एकल क्राफ्टेड HTTP अनुरोध AWS क्रेडेंशियल्स, रहस्यों और आंतरिक सेवा डेटा को localhost:80 से निकालता है।...

8.6CVSS8AI score0.38872EPSS
SaveExploits10
Kitploit
Kitploit
added 2026/08/27 12:52 a.m.3 views

CVE-2020-7693

CVE-2020-7693 PoC Note : Je confirme que la charge utile pour CVE-2020-7693 peut être exécutée dans un programme de Bug Bounty Description : Une gestion incorrecte de l'en-tête Upgrade avec la valeur websocket entraîne un crash des conteneurs hébergeant des applications sockjs. Cela affecte le...

5.3CVSS6.3AI score0.04978EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/27 12:05 a.m.3 views

CVE-2026-44578-PoC

CVE-2026-44578 - PoC لثغرة SSRF عبر WebSocket في Next.js الثغرة: تزوير الطلبات من جانب الخادم SSRF في معالج ترقية WebSocket في Next.js 13.4.13 → 15.5.15, 16.0.0 → 16.1.6 الاستخدام root@kitploit: Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel to internal Redis python3 poc.py...

8.6CVSS8AI score0.38872EPSS
SaveExploits10
Kitploit
Kitploit
added 2026/08/26 11:30 p.m.2 views

nextssrf

root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...

8.6CVSS8AI score0.38872EPSS
SaveExploits10References3
Kitploit
Kitploit
added 2026/08/26 8:48 p.m.2 views

cve-2018-1002105

CVE-2018-1002105 Utility di test che verifica se un cluster è affetto dalla vulnerabilità Kubernetes ad alta severità pubblicata qui. Un'analisi a livello stakeholder della CVE-2018-1002105 è disponibile su https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/...

9.8CVSS8.5AI score0.86978EPSS
SaveExploits10References1
Kitploit
Kitploit
added 2026/08/26 8:02 p.m.3 views

CVE-2026-44578

🚨 CVE-2026-44578 — Vulnerabilidade SSRF no Next.js 📌 Visão Geral CVE-2026-44578 é uma vulnerabilidade de alta gravidade do tipo Server-Side Request Forgery SSRF que afeta aplicações Next.js auto-hospedadas. Atacantes podem explorar solicitações de upgrade WebSocket maliciosas para forçar o servid...

8.6CVSS8AI score0.38872EPSS
SaveExploits10References1
Kitploit
Kitploit
added 2026/08/26 11:41 a.m.2 views

cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request-Smuggling CWE-444 Request-Smuggling über abgelehntes WebSocket-Upgrade in aiohttp Oder die Rust-Version bauen keine Abhängigkeiten, nur Standardbibliothek: root@kitploit: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd...

6.3CVSS5.5AI score0.00431EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/26 7:35 a.m.2 views

cve-2018-1002105

Questo è stato modificato da https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. Tutto il merito va alle gentili persone di Gravitational. Il codice PoC originale è stato modificato per andare un po' oltre la verifica della vulnerabilità e per eseguire...

9.8CVSS8.5AI score0.86978EPSS
SaveExploits10
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.9 views

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

6.3CVSS5.5AI score0.00431EPSS
SaveExploits1References8
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.9 views

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

6.3CVSS5.5AI score0.00431EPSS
SaveExploits1References8
RedHat Linux
RedHat Linux
added 2026/08/12 7:35 p.m.10 views

Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests

A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery SSRF through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or...

8.6CVSS8AI score0.38872EPSS
SaveExploits10References5
RedhatCVE
RedhatCVE
added 2026/08/11 11:50 a.m.10 views

CVE-2026-69243

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

7CVSS5.7AI score0.00431EPSS
SaveExploits1References7
SUSE CVE
SUSE CVE
added 2026/08/05 12:29 a.m.11 views

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

5.3CVSS5.5AI score0.00431EPSS
SaveExploits1References3
PyPA
PyPA
added 2026/08/04 11:34 a.m.38 views

AIOHTTP: HTTP request smuggling via WebSocket upgrade

SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...

6.3CVSS5.6AI score0.00431EPSS
SaveExploits1References8Affected Software1
OSV
OSV
added 2026/08/04 11:34 a.m.21 views

PYSEC-2026-3546 AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...

6.3CVSS5.6AI score0.00431EPSS
SaveExploits1References8
Tenable Nessus
Tenable Nessus
added 2026/08/04 12:00 a.m.16 views

Linux Distros Unpatched Vulnerability : CVE-2026-69243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack...

6.3CVSS5.6AI score0.00431EPSS
SaveExploits1References3
NVD
NVD
added 2026/08/03 9:16 p.m.15 views

CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

6.3CVSS0.00431EPSS
SaveExploits1References4
OSV
OSV
added 2026/08/03 8:46 p.m.8 views

GHSA-MFX4-HV73-Q22V AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...

6.3CVSS5.6AI score0.00431EPSS
SaveExploits1References5
Github Security Blog
Github Security Blog
added 2026/08/03 8:46 p.m.32 views

AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...

6.3CVSS5.6AI score0.00431EPSS
SaveExploits1References5Affected Software1
Rows per page
Query Builder