CVE-2024-54679

CVE-2024-54679 CVE-2024-54679 - CyberPanel aka Cyber Panel Denial of Service Description A denial of service DoS vulnerability was discovered in Cyber Panel that allows any authenticated user to restart the database by sending requests to the /dataBases/restartMySQL endpoint. This vulnerability...

CVE-2020-11890

Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...

CVE-2024-38473-Nuclei-Template

CVE-2024-38473 Nuclei Template Description Nuclei template designed to detect Apache servers vulnerable to CVE-2024-38473. It first identifies servers running Apache 2.4.60 with default PHP-FPM settings. Then, it fuzzes for potential PHP files protected by ACLs that might be bypassed due to this...

CVE-2026-59739

A flaw was found in Apache ZooKeeper. This vulnerability allows a remote attacker to discover paths that should be restricted by Access Control Lists ACLs. By registering watches on non-existent paths and then reconnecting after these paths are created with restricted ACLs, the attacker can bypas...

CVE-2021-40346

CVE-2021-40346: HAProxy HTTP Request Smuggling - ACL Bypass Overview This project demonstrates CVE-2021-40346 , a critical integer overflow vulnerability in HAProxy that enables HTTP Request Smuggling attacks to bypass security controls. CVSSv3 Score: 7.5 High Contributors: 1. Boian Eduard 2...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

Apache HTTP Server - ACL Bypass

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. id: CVE-2024-38473 info: name: Apache HTTP Server - ACL Bypass author: pdteam severity: high...

CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling Vulnerability Summary HAProxy is an open-source reverse proxy and load balancer that handles load distribution and ACL access control rules processing. CVE-2021-40346 is an ACL bypass vulnerability that occurs when HAProx...

CVE-2022-33891

「💥」CVE-2022-33891 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BypassFuzzer

Bypass Fuzzer The original 403fuzzer.py : ==Note: This has been deprecated for my new, shiny burp extension that is 1000000% better. Thank you for using my tools!== You can find the extension here: https://github.com/intrudir/BypassFuzzer-Burp Fuzz 401/403ing endpoints for bypasses Perform variou...

Cisco-SNMP-Slap

OVERVIEW cisco-snmp-slap utilises IP address spoofing in order to bypass an ACL protecting an SNMP service on a Cisco IOS device. Typically IP spoofing has limited use during real attacks outside DoS. Any TCP service cannot complete the inital handshake. UDP packets are easier to spoof but the...

CVE-2026-72815-poc

CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC 日本語版 Overview This repository contains a local Proof of Concept PoC for CVE-2026-72815 GHSA-3fxj-6jh8-hvhx, an IP spoofing vulnerability in go-chi/chi's middleware.RealIP. The vulnerable middleware blindly trusts the first leftmost valu...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass + Attachment sourceId Path Traversal + .htaccess Poisoning Author : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Product : EspoCRM = 9.3.3 Auth : Admin credentials required...

CVE-2026-24306

Azure Front Door Privilege Escalation – CVE-2026-24306 PoC For authorized red team / research use only. Author not responsible for misuse. Vulnerability allows: Arbitrary routing rule injection Backend pool / origin group modification WAF policy attachment / override Custom domain takeover on...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE 🔐 Apache Spark UI is susceptible to a remote command injection vulnerability identified as CVE-2022-33891. This flaw arises due to improper handling of user authentication and access control, specifically when Access Control Lists ACLs ar...

CVE-2025-12748

CVE-2025-12748 Eng Rus Credit: Svyatoslav Tereshin @TERESH1, Artem Mukhin @saladosss Issues: 687, 825 English Description An issue was discovered in the XML file processing procedure. The processing of the file's content is performed before the ACL check. This allows a user with limited permissio...

CVE-2026-63131

A flaw was found in OpenBao, an open source identity-based secrets management system. This vulnerability allows an authenticated attacker to bypass Access Control List ACL deny rules for LIST operations. By sending a specially crafted LIST request with a trailing-slash, an attacker can list paths...

CVE-2026-90904

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...

EUVD-2026-85550

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...