h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

EUVD-2026-102869

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18...

CVE-2026-18662

A flaw was found in Eclipse Jetty. When multiple security constraints are configured with identical HTTP method omission definitions and no URL patterns, the server improperly overrides earlier constraints rather than combining their rules as required by the Jakarta Servlet specification. A remot...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling For educational purposes only Setup $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirm /admin is denied. $ curl...

CVE-2024-48208

CVE-2024-48208 The repo contains all the work surrounding the development of the PoC for how a simple OOBOut-of-bound read can result in jail escapes as well as broken access control. About the Vulnerability The orginial CVE Description is as follows: The Github PR on the official repo details ou...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

Forbidden-Buster

Forbidden Buster is a tool designed to automate various techniques in order to bypass HTTP 401 and 403 response codes and gain access to unauthorized areas in the system. This code is made for security enthusiasts and professionals only. Use it at your own risk. Features Probes HTTP 401 and 403...

CVE-2026-18660

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

Symfony HttpFoundation - Access Control Bypass via PATH_INFO

Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...

LolLMS <= 2.2.0 - Unauthenticated File Upload

A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Dependsgetcurrentactiveuser dependency used by other file-related APIs. id: CVE-2026-0558 info: name:...

N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 id: CVE-2026-86206 info: name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing author:...

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...

GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...

CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Plug-in Access-Control Bypass via URI Normalization Inconsistency An independently reproduced exploit and analysis for CVE-2026-21962 improper access control, CVSS 10.0 in Oracle HTTP Server / the Oracle WebLogic Server Proxy Plug-in for...

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - FileBrowser Access Control Bypass Unauthenticated users cannot exploit this — requires valid low-privileged credentials that are restricted from the target path. Path-based authorization bypass in FileBrowser ≤ v2.57.0 using multiple leading slashes //private instead of /private ...

CVE-2026-25924

CVE-2026-25924 PoC - Kanboard Admin RCE Proof-of-Concept for Administrative RCE via Security Control Bypass Disclosure: Originally reported by me via GHSA-grch-p7vf-vc4f ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID| CVE-2026-25924 Severity| 🔴...

CVE-2021-40346

CVE-2021-40346 Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy in this case 2.2.16 and one with a Flask web server using Gunicorn as...

ksmbrace

ksmbrace Vulnerability research in ksmbd , the Linux kernel's in-kernel SMB3 server fs/smb/server/. Authenticated-attacker flaws on the durable-handle and path-resolution paths of ksmbd. The name nods to the race-condition theme of this line of work see the withheld byte-range-lock UAF,...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – GraphQL Persisted Queries Injection via ID Manipulation Program Code Node.js // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql',...