Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

TBK DVR4104/DVR4216 Devices - Authentication Bypass

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

CVE-2025-29927-POC

CVE-2025-29927-POC 简介 本仓库包含 CVE-2025-29927 的概念验证（PoC），这是一个假设的漏洞，演示了 Web 应用程序中中间件处理的缺陷。该 PoC 展示了如何利用特制的 HTTP 请求绕过重定向逻辑，访问受限内容（例如仪表盘）。本项目仅用于教育和安全研究目的。 免责声明 ：本 PoC 仅限在获得明确许可的受控环境中使用。未经授权对您不拥有或未获得测试同意的系统进行测试是非法且不道德的。 目录 先决条件 漏洞概述 概念验证步骤 步骤 1：初始请求（失败） 步骤 2：修改后的请求（成功） 如何复现 参考资料 贡献 许可证 先决条件 要跟随本 PoC，您需要...

spring-cloud-function-rce

Spring Cloud Function SPEL式注入の脆弱性（CVE-2022-22963） Springフレームワークは、現代のJavaベースのエンタープライズアプリケーション（あらゆるタイプのデプロイプラットフォーム上）に対して、包括的なプログラミングおよび構成モデルを提供します。 Spring CloudのサーバーレスフレームワークであるSpring Cloud...

CVE-2025-6783

WHERE句に常に真となる条件を注入し、全ての行が一致するようにします: root@kitploit: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0 ' ...

HTTP3ONSTEROIDS

目次 脆弱性の説明 ソースコードレビュー ラボのセットアップ 問題の特定 参考文献 脆弱性の説明 HAProxyのHTTP/3実装は、不正なHTTPヘッダーフィールド名 をブロックできず、この不正なヘッダーを誤って処理するサーバーの前段にデプロイされた場合 、HTTPリクエスト/レスポンススマグリング攻撃に悪用される可能性があります。リモートの攻撃者は、正規ユーザーのリクエストを改ざんする可能性があります。その結果、攻撃者は機密情報を取得したり、サービス妨害（DoS）状態を引き起こしたりする可能性があります。 https://jvn.jp/en/jp/JVN38170084/...

CVE-2022-30333-PoC

CVE-2022-30333-POC CVE-2022-30333 をテストするためのサンプルファイル Sample.rar : Linux でテストしたい場合。展開すると、../../tmp/traversed に trav が作成されます。Sample.rar を展開する前に、ディレクトリ ../../tmp/traversed が存在することを確認してください。 exp.rar : Zimbra Mail サーバでテストしたい場合。展開すると、/opt/zimbra/jettybase/webapps/zimbra/public/ に moo.txt が作成されます。このファイルに...

BypassFuzzer

Bypass Fuzzer The original 403fuzzer.py : ==Note: This has been deprecated for my new, shiny burp extension that is 1000000% better. Thank you for using my tools!== You can find the extension here: https://github.com/intrudir/BypassFuzzer-Burp Fuzz 401/403ing endpoints for bypasses 헤더, 경로 정규화, HT...

DVRFaultNET

DVRFaultNET .NET 콘솔 애플리케이션으로 DVR CVE-2018-9995 취약점을 익스플로잇합니다. 사용법 실행되면 DVR 카메라의 URL을 입력하라는 메시지가 표시됩니다. 프로그램은 URL에 ?opt=user&cmd=list를 추가하고 "Cookie:uid=admin" 헤더를 포함한 요청을 보냅니다. 그러면 서버가 JSON 문자열을 반환하여 모든 사용자 자격 증명을 제공합니다...

SC3010-Computer-Security

SC3010-Computer-Security — CVE-2017-5638 Attack Recreation This repository is part of the SC3010 Computer Security course project. It recreates CVE-2017-5638 , a critical Remote Code Execution vulnerability in Apache Struts 2 versions 2.3.5–2.3.31 and 2.5–2.5.10, famously exploited in the 2017...

CVE-2026-51773

The VMware datastore driver of OpenStack glance_store contains a vulnerability where an authenticated attacker can provide a maliciously crafted image location URI. The _retry_request function fails to validate the destination host before attaching sensitive authentication headers, potentially le...

Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Overview Three cross-site scripting XSS vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successf...

CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

openSUSE 16: httpcomponents-client / httpcomponents-client-cache / etc (openSUSE-SU-2026:21894-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21894-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager...

Linux Distros Unpatched Vulnerability : CVE-2026-98096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at...

EUVD-2026-87084

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

UBUNTU-CVE-2026-98096

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

CVE-2025-59342

CVE-2025-59342 - 경로 탐색 esm-dev 작성자: Byte Reaper 설명 CVE-2025-59342는 esm.sh의 경로 탐색 취약점입니다. esm.sh는 최신 웹 개발을 위한 nobuild 콘텐츠 전송 네트워크CDN로, 버전 136 및 이전 버전에서 영향을 받습니다. 이 문제는 X-Zone-Id HTTP 헤더를 처리하는 방식에 존재하며, 이 헤더는 파일 시스템 경로를 구성하는 데 사용됩니다. 헤더 값이 적절하게 정규화되거나 애플리케이션의 스토리지 기본 디렉터리로 제한되지 않습니다. 결과적으로 X-Zone-I...