CVE-2026-23918

CVE-2026-23918: Apache HTTP/2 Double-Free DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67 A double-free vulnerability in modhttp2 h2mplx.c allows remote attackers to cause a denial of service worker crash via rapid RSTSTREAM frames that trigger a...

CVE-2021-41773-i-

CVE-2021-41773 CVE-2021-41773 POC with Docker Configuration To customize the httpd.conf file, change line 251 in the section from Require all denied to Require all granted. AllowOverride none Require all granted Create a Dockerfile in your project FROM httpd:2.4.49 COPY ./httpd.conf...

CVE-2025-24813-POC

CVE-2025-24813: Apache Tomcat RCE Proof of Concept This repository provides a controlled, automated environment to demonstrate Remote Code Execution RCE vulnerabilities in Apache Tomcat via CVE-2025-24813. Overview This PoC exploits misconfigured file-based session persistence in Apache Tomcat's...

CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 Path Traversal & RCE 📖 Description This is a proof-of-concept exploit for CVE-2021-41773, a path traversal and remote code execution vulnerability in Apache HTTP Server 2.4.49. Vulnerability Details CVE : CVE-2021-41773 Affected Version : Apache HTTP...

synaptic-sentinel

SYNAPTIC Sentinel The vibe-coding security sentinel. An Apache-2.0 agentic security toolkit for projects where most of the code is written by AI. Five deterministic scouts catch the syntactic problems; a Brain Layer BYOK Anthropic decides what really matters and how to fix it — all inside the IDE...

cybersecurity_portfolio

Portfolio. Gleb Usoltsev Second-year student, Institute of Computer Science and Cybersecurity, Peter the Great St. Petersburg Polytechnic University, field of study 10.03.01 «Information Security». As part of the educational introductory practice at Positive Technologies JSC, two practical cases...

cve-2021-41773

CVE-2021-41773 CVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited Apache HTTP Server CVE-2021-41773 Exploited in the Wild CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 incomplete fix of CVE-2021-41773 Shodan oneliner shodan...

Struts-Apache-ExploitPack

Struts-Apache-ExploitPack These are just some scripts which you can use to detect and exploit the Apache Struts Vulnerability CVE-2017-5638 There is a MassScanner and Exploiter, You can use scanner to Mass Scan a list of URLs and then exploit them by Exploiter. The Exploiter will run arbitrary...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2021-41773-Playground

CVE-2021-41773-Playground Some docker images to play with CVE-2021-41773 and CVE-2021-42013 run docker compose up -d to spin up all the containers. Servers will run on ports 8080, 8081, 8082, and 8083. 8080 contains an Apache 2.4.49 with CGI disabled. 8081 contains an Apache 2.4.49 with CGI...

CVE-2020-1938_Ghostcat-PoC

CVE-2020-1938Ghostcat-PoC - CVE-2020-1938 A powerful Python exploit tool for Apache Tomcat AJP Ghostcat vulnerability CVE-2020-1938 with advanced features for penetration testing and security research. 🔍 Overview The Ghostcat vulnerability CVE-2020-1938 allows attackers to read arbitrary files fr...

CVE-2026-23918-Passive-Audit

CVE-2026-23918 audit script alternatively you could just curl the headers and take a peek, but here comes the: Non-invasive HTTP metadata auditor for Apache HTTP Server CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 exposure triage. The tool sends ordinary HTTP HEAD/GET...

IfritProxy

🔥 AI-Powered Threat Deception & Intelligence Platform Turn attackers into intelligence sources with adaptive honeypot responses 📦 Quick Start • ✨ Features • 🔄 How It Works • 📚 Docs • 🔌 API Brought to the community by 🎯 What is IFRIT? IFRIT is an intelligent reverse proxy that sits between the...

java-vulnerable

Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

Investigation Report on Struts2 Vulnerabilities S2-054, S2-055 and Jackson Vulnerability CVE-2017-7525, CVE-2017-15095 We have published a summarized article that condenses the key points for easier reading. Recommended for those who want to get an overview first or don't have much time. SSTtechl...

CVE-2025-59059-Misattributed-RCE-in-Apache-Ranger-Static-Analysis-Correction

CVE-2025-59059: Misattributed RCE in Apache Ranger a correction CVE: CVE-2025-59059 Affected versions: Apache Ranger "Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions = 2.7.0." this is wrong, or at least misleading. NashornScriptEngineCreator...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass An advanced, highly reliable Proof of Concept PoC exploit for CVE-2024-27348 Remote Code Execution in Apache HugeGraph Server. Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec...