BurpSuite_403Bypasser

403Bypasser An burpsuite extension to bypass 403 restricted directory. By using PassiveScan default enabled, each 403 request will be automatically scanned by this extension, so just add to burpsuite and enjoy. Payloads: $1: HOSTNAME $2: PATH $1/$2 $1/%2e/$2 $1/$2/. $1//$2// $1/./$2/./...

CVE-2022-1388

CVE-2022-1388 POC for CVE-2022-1388 affecting multiple F5 products. Follow the Horizon3.ai Attack Team on Twitter for the latest security research: Horizon3 Attack Team James Horseman Zach Hanley Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2025-29927-POC

CVE-2025-29927-POC Introduction This repository contains a Proof of Concept PoC for CVE-2025-29927, a hypothetical vulnerability demonstrating a flaw in middleware handling within a web application. The PoC illustrates how a specially crafted HTTP request can bypass redirection logic to access...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authentication Bypass Advanced Bypass 🔥 Overview An advanced PoC for CVE-2025-29927 , allowing authentication bypass in Next.js Middleware by manipulating specific headers. This template enhances WAF evasion and security bypass techniques. 🚀 Features ✅...

CVE-2025-29927

Next.js Middleware Authorization Bypass Vulnerability Test Environment CVE-2025-29927 📌 Project Overview This repository provides a local environment for testing the Next.js middleware authorization bypass vulnerability CVE-2025-29927. This vulnerability allows attackers to bypass middleware...

nomore403

NoMore403 nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses. The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control...

CVE-2025-29927

CVE-2025-29927 ★ CVE-2025-29927 Next.js middleware bypass PoC ★ Description CVE-2025-29927 : Next.js middleware bypass PoC description: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it i...

nextjs-vulnerable-app

Next.js Authentication App This is a Next.js application that implements authentication using NextAuth.js. The app features protected routes that require users to be authenticated to access certain pages. Project Structure nextjs-auth-app ├── components │ ├── Layout.js Layout component for...

CVE-2025-31161

CrushFTP CVE-2025-31161 Exploit Tool 🔓 Advanced detection and exploitation tool for CVE-2025-31161 vulnerability in vulnerable CrushFTP versions. CVE-2025-31161 is a critical authentication bypass vulnerability in the CrushFTP Web Interface. By manipulating the HTTP Authorization header, an...

CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspace ONE, vIDM, and vRealize Automation 7.6. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

NextBypass

NextBypass 🚨 Next.js Middleware Authorization Bypass Tool CVE-2025-29927 Features Exploit CVE-2025-29927 via x-middleware-subrequest header Auto-browser integration Proxy/Bookmarklet Vulnerability scanning & log analysis Network traffic monitoring Installation git clone...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

CVE-2025-29927

CVE-2025-29927: The Next.js Middleware Nightmare This repository is provided strictly for educational purposes only. I did not discover this vulnerability - this is a demonstration and explanation of a publicly disclosed security issue. Using this knowledge to exploit vulnerable systems without...

CVE-2023-4631

CVE ID : CVE-2023-4631 Vulnerability Type : IP Address Spoofing Description : The DoLogin Security plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 3.6. This is due to insufficient restrictions on where the IP Address information is being retrieved for...

Forbidden-Buster

Forbidden Buster is a tool designed to automate various techniques in order to bypass HTTP 401 and 403 response codes and gain access to unauthorized areas in the system. This code is made for security enthusiasts and professionals only. Use it at your own risk. Features Probes HTTP 401 and 403...

CVE-2025-29927

CVE-2025-29927 Next.js Middleware Authorization Bypass The detection template for CVE-2025-29927 is now officially part of the Nuclei Templates repository. https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-29927-HEADLESS.yaml A critical vulnerability in...

POC-CVE-2025-29927-

Affected Next.js 15.x 15.2.3, 14.x 14.2.25, Next.js 13.x 13.5.9 Self-hosted setups that use Middleware for critical functionality, such as authentication. Guide npm run dev curl --compressed -X GET http://localhost:3000/dashboard \ -H "Host: localhost:3000" \ -H "sec-ch-ua: "Chromium";v="135",...

CVE-2024-40324

CVE-2024-40324 Description A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Vulnerability Type CRLF Vendor of Product E-Staff Affected Product Cod...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint $ curl...