1692 matches found
CVE-2015-8562
CVE-2015-8562 - Reverse shell python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: Vuln Date: 12/17/2015 Exploit Author: anarc0der Version: Joomla 1.5 to 3.4.5 CVE : CVE-2015-8562 How to: Open one terminal and listen with nc: $ nc -lnvp 4444 Open another terminal and...
CVE-2025-22457
CVE-2025-22457 CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE This script helps identify Ivanti Connect Secure, Policy Secure, or ZTA Gateways that may be vulnerable to CVE-2025-22457 , a critical unauthenticated stack-based buffer overflow in the web process...
ivantiunlocker
ivantiunlocker Prevent CVE-2025-22457 and other security problems with Juniper/Ivanti Secure Connect SSL VPN Many security issues around SSL VPN devices recently. You can't feel safe anymore. And then there is CVE-2025-22457 ! Read the story behind it :...
CVE-2019-19633
CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...
Silent-Call
Silent;Call Pre-authentication remote root on Cisco Unified Communications Manager 15.x Three HTTP requests. Zero credentials. Root access. Every call is now yours. Kill Chain Step| Component| Description ---|---|--- 1| Spoofhack| X-Forwarded-For header spoofing bypasses localhost restriction on...
cakephp-trusted-proxies
abraxaslabs.tech Β· github.com/abraxas Β· @abraxasnull Β· [email protected] Β· cakephp-trusted-proxies cakephp-trusted-proxies Class: HTTPS redirect bypass / IP-host spoof Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation HttpsEnforcerMiddleware with trustedProxies = '10.0.0.1' call...
transfer.sh
SECURITY WARNING IP filter and HTTP auth bypass via unauthenticated X-Forwarded-For header spoofing transfer.sh Easy and fast file sharing from the command-line. This code contains the server with everything you need to create your own instance. Transfer.sh currently supports the s3 Amazon S3,...
requests-ip-rotator
Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries β improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...
CVE-2019-17240
CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...
CVE-2026-27739-POC
-CVE-2026-27739-poc curl -H "X-Forwarded-For: http://169.254.169.254/latest/meta-data/" self.target 2. Header Injection via Prototype Pollution CVSS: 7.5 Description : Angular SSR processes unsafe query parameters affecting prototype chain Impact : Request header manipulation, potential SSRF...
CVE-2015-3224
Ruby on Rails Web Console Exploit CVE-2015-3224 This repository contains a Python script to exploit an IP whitelist bypass vulnerability in the developer web console of Ruby on Rails 4.0.x and 4.1.x. The script allows for remote code execution on vulnerable servers. β οΈ Disclaimer This script is...
CVE-2026-72815-poc
CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC ζ₯ζ¬θͺη Overview This repository contains a local Proof of Concept PoC for CVE-2026-72815 GHSA-3fxj-6jh8-hvhx, an IP spoofing vulnerability in go-chi/chi's middleware.RealIP. The vulnerable middleware blindly trusts the first leftmost valu...
CVE-2022-4539
Usage Considerations: Adaptability: You can easily modify the payloads, IP generation logic, and proxies to match different scenarios or environments. Ethical Use: Ensure you have explicit permission before testing any system with this code. Scalability: This code is designed to be scalable and...
CVE-2024-41276
CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...
CVE-2024-35584
CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...
CVE-2026-37432
CVE-2026-37432 Location: Apiutil.java: 107-113 Principle: Directly trusting the X-Forwarded-For request header, which can be forged to manipulate IP addresses. Exploitation method: X-Forwarded-For: 127.0.0.1...
Limit Login Attempts WordPress - Stored Cross-site Scripting
Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...
CVE-2025-2825-CrushFTP-AuthBypass
π¨ CVE-2025-2825 β CrushFTP Authentication Bypass π Overview CVE-2025-2825 is a critical authentication bypass vulnerability affecting CrushFTP , a widely used secure file transfer server. The flaw allows remote attackers to bypass login authentication and gain administrative access by spoofing...
Typecho-Multiple-Vulnerabilities
Typecho Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2024-35538: In Typecho v1.3.0 there is a Client IP Spoofing vulnerability, which allows malicious actors to falsify their IP addresses by specifying an arbitrary IP as value of...
CVE-2015-3224
CVE-2015-3224 Exploit - Rails Web Console RCE A JavaScript implementation Node.js of the exploit for CVE-2015-3224. This tool targets Ruby on Rails applications running vulnerable versions of the web-console gem, allowing unauthenticated Remote Code Execution RCE. About the Vulnerability...