NextJS_CVE-2025-29927

Next.js Authorization Bypass Demo This application demonstrates the x-middleware-subrequest vulnerability in Next.js 13.4.19, which allows bypassing middleware protection. Setup 1. Install dependencies: root@kitploit: npm install 2. Start the development server: root@kitploit: npm run dev...

CVE-2022-4539

Consideraciones de uso: Adaptabilidad: Puede modificar fácilmente las cargas útiles, la lógica de generación de IP y los proxies para adaptarse a diferentes escenarios o entornos. Uso ético: Asegúrese de tener permiso explícito antes de probar cualquier sistema con este código. Escalabilidad: Est...

log4j-jndi-be-gone

log4j-jndi-be-gone A Byte Buddy Java agent-based fix for CVE-2021-44228, the log4j 2.x "JNDI LDAP" vulnerability. It does three things: Disables the internal method handler for jndi: format strings "lookups". Logs a message to System.err i.e stderr indicating that a log4j JNDI attempt has been ma...

nextjs-cve-2025-29927

Next.js CVE-2025-29927 中间件漏洞 该仓库是一个使用 Next.js 15.2.3 和 Next.js 15.1.7 版本比较 CVE-2025-29927 中间件漏洞的 monorepo 项目。 漏洞描述 CVE-2025-29927 是 Next.js 中间件中发现的一个安全漏洞，可以通过使用 x-middleware-subrequest 头绕过认证中间件。 该漏洞影响以下版本： Next.js 15.x 15.2.3 Next.js 14.x 14.2.25 Next.js 13.x 13.5.9 上述版本已通过更新到相应补丁版本得到修复。 运行方法 1...

x-middleware-exploit

This repository does not have a README...

HydraDragonAV-Mobile

🐉 HydraDragonAV Mobile Advanced Android Antivirus With Threat Protection ⚠️ Project on hold. This project did not get enough interest, so I have paused it for a while. Development has moved to HydraDragonAntivirus. Discord Community Server: https://discord.gg/7XMCuj5mbP Logo made by discord user...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Bypass ⚠️ Critical Authentication Bypass in NextJS Middleware 🛠️ PoC implementation by @zs1n 💡 Overview NextJS is a popular React-based web framework, has an authentication vulnerability that affects versions prior to 12.3.5, 13.5.9,...

CVE-2019-11287

CVE-2019-11287: DoS mediante desbordamiento de montón en el plugin de administración web de RabbitMQ Pivotal RabbitMQ, versiones 3.7.x anteriores a 3.7.21 y 3.8.x anteriores a 3.8.1, y RabbitMQ para Pivotal Platform, versiones 1.16.x anteriores a 1.16.7 y 1.17.x anteriores a 1.17.4, contienen un...

cve-2025-29927

cve-2025-29927 CVE-2025-29927 es una vulnerabilidad crítica en Next.js, un popular framework web basado en React. La falla existe en cómo la función de middleware maneja ciertos encabezados internos — específicamente, el encabezado x-middleware-subrequest...

next-attack

This is a Next.js project bootstrapped with create-next-app. Testing the vulnerability First, you can confirm that the middleware works and should redirect the user: root@kitploit: curl http://localhost:3000/api/admin Then, you can show how the middleware is being bypassed with the followign...

CVE-2025-29927

CVE-2025-29927 – Omisión de Autorización de Middleware de Next.js Este repositorio contiene un exploit funcional para CVE-2025-29927, una vulnerabilidad crítica de omisión de autorización en Next.js. El fallo permite a los atacantes eludir las comprobaciones de autenticación y autorización basada...

-cve-2025-55182

CVE-2025-55182 Script de detección por lotes / URL única image Una herramienta eficiente de detección de la vulnerabilidad CVE-2025-55182, que admite detección rápida de una sola URL y detección por lotes de URLs, generando automáticamente un informe detallado en Excel y un archivo de registro...

Drupalgeddon-Python3

Drupalgeddon Python3 Edition An rewritten POC on the CVE-2014-3704, done as part of my CPTS training on HackTheBox. https://nvd.nist.gov/vuln/detail/CVE-2014-3704 CVE-2014-3704 known as Drupalgeddon, affects versions 7.0 up to 7.31 and was fixed in version 7.32. This was a pre-authenticated SQL...

BIT-RCLONE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2017-7504-poc

JBoss 4.x JBossMQ JMS Deserialization Vulnerability poc -h view usage instructions...

CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml The essence of this vulnerability is similar to CVE-2021-45232, both bypass authorization or are unauthenticated, to execute malicious filterfunc or script in a route to execute commands...

mi-x

Am I Exploitable? Author: 2022 - Now, Rezilion Description: Vulnerabilities validation Development: January 2022 - Now Documentation: See website, README Introduction Description ‘Am I Exploitable?’ is a python open source project that comes to meet the need of validating if your system is...

CVE-2025-29927

CVE-2025-29927 Reproducción y corrección de la vulnerabilidad CVE-2025-29927. root@kitploit: git clone [email protected]:Bongni/CVE-2025-29927.git cd CVE-2025-29927 En vulnerable/ hay una versión de la aplicación que es vulnerable al ataque. En fixed/ hay una versión de la aplicación que est...

SPIP-CVE-2024-23659-

SPIP-CVE-2024-23659- Script en Python 3 para validación/explotación de RCE no autenticado en SPIP BigUp Descripción cve.py automatiza: 1. Descubrimiento de formulario SPIP formulaireaction y formulaireactionargs. 2. Envío de payload multipart para ejecutar comandos en el servidor objetivo. 3...

CVE-2026-89093

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...