CVE-2021-21300

CVE-2021-21300 In multiple versions of git, the handling of symbolic links is not strict. After uploading files to git on a case-sensitive file system e.g., Linux, cloning a malicious repository on a host using a case-insensitive file system e.g., Windows may lead to remote command execution...

CVE-2024-32002

CVE-2024-32002: Exploiting Git RCE via git clone This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on...

httpgrep

Description A fast, asynchronous Python tool that scans HTTPS servers and greps for strings or regex patterns in HTTP response bodies and headers. It takes single hosts, URLs, CIDR ranges, IP ranges or files; scans multiple ports per target single, comma-lists or ranges, auto-detecting TLS vs pla...

hook

amalmurali47/hook This repository is part of the PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. This repository contains the malicious hook used in the exploit. Overview For detailed instructions and an explanation of how the exploit works,...

CVE-2024-32002

CVE-2024-32002: Exploiting Git RCE via git clone This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on...

NPM: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

NPM: Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive vulnerability discovered by ? in WordPress npm nuxt versions = 3.0.0, 4.0.0...

EUVD-2026-107416

Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive...

CVE-2026-114132

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114132

The Nuxt web development framework is vulnerable prior to version 4.6.2 due to a discrepancy in how it handles case sensitivity. While Nuxt resolves pages case-insensitively by default, the Nitro engine matches server-side route-rule keys case-sensitively. This allows requests with paths differin...

PT-2026-120735

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.2 Description Nuxt resolves pages case-insensitively by default, whereas Nitro matches server-side route-rule keys case-sensitively. This discrepancy allows requests with paths that differ only by letter case to rend...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation and POC This repository contains a Proof of Concept POC for CVE-2024-50379 , a vulnerability affecting Apache Tomcat. The issue involves a Time-of-Check Time-of-Use TOCTOU race condition , which can lead to Remote Code Execution RCE , especially on case-insensitive fil...

CVE-2021-21300

CVE-2021-21300: Arbitrary Code Execution via Malicious Git Hooks 📌 Summary CVE-2021-21300 is a critical vulnerability in Git versions 2.14.2 to 2.30.1 that allows attackers to execute arbitrary code on victim machines by exploiting symbolic links and case-insensitive file systems. 🧠 Problem...

git_rce

Remote Code Execution Attack via git clone CVE-2024-32002 Contributors 이정우@Roronoawjd Background This vulnerability is a Remote Code Execution RCE vulnerability that occurs when cloning a git repository containing submodules on case-insensitive file systems such as Windows and macOS. RCE is a...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell This script demonstrates how to exploit CVE-2024-32002 to obtain a reverse shell, providing remote access to the affected system. Use it with caution in controlled environments and only for educational or security testing purposes. Blog Post This script is inspired by...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation and POC This repository contains a Proof of Concept POC for CVE-2024-50379 , a vulnerability affecting Apache Tomcat. The issue involves a Time-of-Check Time-of-Use TOCTOU race condition , which can lead to Remote Code Execution RCE , especially on case-insensitive fil...

CVE-2026-111448

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

Astra Linux – Vulnerability in curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuercert’ into account, and it compared the involved paths case insensitively, which could...

git_rce

CVE-2024-32002: Explotando RCE en Git mediante git clone Este repositorio contiene un PoC para explotar CVE-2024-32002, una vulnerabilidad en Git que permite RCE durante una operación de git clone. Al crear repositorios con submódulos de una forma específica, un atacante puede explotar el manejo ...

CVE-2026-107336 Authentication Bypass by Spoofing in Malcolm

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase for example /IDDASH2ARK/... enters the location the matcher fires but evades the rewrite n...