Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Kong Admin <=2.03 - Admin API Access

Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1. id: CVE-2020-11710 info: name: Kong Admin =2.03 - Admin API Access author: pikpikcu severity: critical description: Kong Admin through 2.0.3 contains an issue v...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

CVE-2026-117635 Gitea admin API public-only token scope bypass

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

CVE-2026-117635

The Gitea software contains a vulnerability where the /api/v1/admin route group fails to enforce the public-only restriction on personal access tokens. This allows a public-only token with admin scope, issued by a site administrator, to perform unauthorized actions such as listing private organiz...

CVE-2026-117635 Gitea admin API public-only token scope bypass

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

CVE-2022-24112

Apache APISIX 2.12.x Remote Code Execution RCE Exploit This Python script is a Proof-of-Concept PoC for a remote code execution RCE vulnerability in Apache APISIX versions 2.12.0 and 2.12.1. The vulnerability lies in the misuse of the filterfunc Lua field within the admin API, allowing an attacke...

CVE-2022-24112_POC

POC Collected POCs CVE-2022-24112 To set up the Chunqiu Cloud Environment: CVE-2022-24112 target environment, two POCs were modified, slightly adapted from the POCs of M4xSec and twseptian for the Chunqiu Cloud Environment: Chunqiu Cloud Environment: CVE-2022-24112: Apache APISIX is a cloud-nativ...

Apache-APISIX-CVE-2022-24112

Apache APISIX Remote Code Execution CVE-2022-24112 Exploit Summary An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key w...

CVE-2026-117635: Gitea: The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

cve-2022-24112

Apache APISIX 2.12.1 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples. In this docker-compose.yml file, we already change into image: apache/apisix:2.12.0-alpine, because the vulnerability in this version, then let's...

CVE-2025-28062

CVE-2025-28062 — CSRF Vulnerability to Account Takeover in ERPNext 14.82.1 , 14.74.3 📌 Summary A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNext 14.82.1 and 14.74.3 , allowing attackers to perform unauthorized actions such as: User enumeration Account takeover password res...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

kong-pwn

kong-pwn Use Exposed KongAPI to act like a proxy and get metadata urls or internal urls. CVE-2020-11710 - It's not a vuln it's a misconfiguration. How to use usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are required: -u/--url, -s/--ssrf Example $ pytho...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard api unauth rce Version: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

VulnCheck KEV: CVE-2020-13945

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...