2045 matches found
CVE-2026-10818
CVE-2026-10818 WPForms Pro = 1.10.1.1 - Écriture arbitraire de fichier non authentifiée via l'ordonnancement Init/Finalize du téléversement par fragments CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — Écriture arbitraire de fichier non authentifiée via le téléversement par fragments Exploit de preuve de...
CVE-2013-4322_PoC
CVE-2013-4322PoC Un simple script Python PoC démontrant la vulnérabilité de transmission lente par morceaux POST...
BigFinger
CVE-2023-46747 - Big-IP RCE غير مُوثَّق هذا سكريبت بلغة Python3 لاستغلال ثغرة تنفيذ الأوامر عن بُعد غير المُوثَّقة CVE-2023-46747 في أجهزة F5 BIG-IP عبر واجهة TMUI. ببساطة، إذا تم استغلال هذه الثغرة، ستحصل على شِل بدون بيانات اعتماد. مبني على تعدد المسارات، ودعم إدخال الملفات، ومعالجة الوكيل، ووص...
CVE-2021-40346
CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling À des fins éducatives uniquement Configuration root@kitploit: $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirmez q...
CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash
Бюллетень безопасности: разбор отрицательного размера чанка вызывает повреждение памяти в facil.io Присвоенный CVE ID : CVE-2026-66731 Продукт: facil.io Затронутые версии: facil.io = 0.7.5 0.7.5, 0.7.6, master; уязвимость появилась при бэкпортировании парсера HTTP/1.1 из 0.8.x в 0.7.5 — отсутству...
Apache2 - Transfer-Encoding Chunked XSS
Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...
CVE-2024-0012_CVE-2024-9474_PoC
🚀 CVE-2024-0012 & CVE-2024-9474 Palo Alto PAN-OS ثغرة استغلال 🔐 🛡️ الوصف هذا النص البرمجي التجريبي PoC يستهدف الثغرات الأمنية في نظام Palo Alto PAN-OS، وتحديداً CVE-2024-0012 و CVE-2024-9474 ، من خلال أتمتة عملية الاستغلال، بما في ذلك تجاوز المصادقة، وإنشاء الحمولة، والتوصيل المجزأ، وتنفيذ الأوامر...
CVE-2019-19945_Test
CVE-2019-19945Test Ceci est le code pour le premier CVE proposé 1. Installer Docker 2. Construire et exécuter le serveur cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Obtenir l'IP du conteneur serveur Linux sudo docker container inspect server | grep -i...
CVE-2026-84947
A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection...
CVE-2026-84947
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...
CVE-2026-84947
CVE-2026-84947 affects undici (Node.js HTTP client), specifically its dump interceptor . When a chunked response (no Content-Length) exceeds the configurable maximum body size, the interceptor signals completion early without pausing or aborting the request. The underlying parser then delivers a ...
CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...
EUVD-2026-71517
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...
CVE-2026-84947
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...
CVE-2026-82729
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...
EUVD-2026-71219
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...
CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-
Avis de sécurité : Contrebande de requêtes HTTP via désynchronisation de Transfer-Encoding rouille Identifiant CVE attribué : CVE-2026-67181 Résumé rouille::proxy::proxy transmet l'en-tête Transfer-Encoding du client au backend sans modification, mais écrit le corps de requête que tinyhttp a déjà...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...