CVE-2024-40324

CVE-2024-40324 Description A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Vulnerability Type CRLF Vendor of Product E-Staff Affected Product Cod...

CVE-2021-44228

CVE-2021-44228 PoC Log4Shell ⚠️ Disclaimer: This tool is intended for educational purposes, security research, and controlled test environments only. Using it against systems without explicit permission is illegal and entirely the responsibility of the user. 📌 Description This project contains a...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2025-29927-NextJs-Middleware-Simulation

CVE-2025-29927: Next.js Middleware Authorization Bypass Simulation This repository demonstrates the exploitation of CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass middleware-based authorization checks. The flaw stems from improper handling of the internal...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-12424

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

cve_2026_98432_guard

CVE-2026-98432 — Temporary XDP Mitigation Status: Temporary mitigation — not a permanent fix Platform tested: Linux / Ubuntu 20.04 should work upwards Kernel tested: 5.15.0-124-generic Expected to work on newer Linux kernels providing the required eBPF and generic XDP functionality. Compatibility...

py-log4shellscanner

PY-Log4ShellScanner A simple, one-file DNSLog server with HTTP endpoint for log retrieval Credit Based on the Log4jScanner by fullhunt.io, modified with multithreading and custom DNS Callback server Features Support for lists of URLs Fuzzing for more than 60 HTTP request headers, with ability to...

CVE-2024-39929

CVE-2024-39929 PoC Vulnerability Brief Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. How does this...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass PoC This repository contains a proof of concept PoC for CVE-2025-29927, a vulnerability in Next.js middleware that allows bypassing authentication and authorization checks through header manipulation. Vulnerability Details Affected Versions : = 11.1.4,...

CVE-2026-111190 ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin...

CVE-2026-111190

The ARForms plugin for WordPress (versions up to and including 7.2.4 ) is vulnerable to an unauthenticated arbitrary file upload via its form file-upload handler. The root cause is that the plugin retrieves the stored filename from an attacker-controlled request header without sufficient restrict...

CVE-2026-12424 ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

EUVD-2026-123270

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2026-12424

The ARforms plugin for WordPress (all versions up to and including 7.2.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the arf_save_incomplete_form_data() AJAX handler. Because this handler is registered with wp...

CVE-2018-5767-AC9

CVE-2018-5767-AC9 An implementation of a proof-of-concept for CVE-2018-5767 https://vulners.com/cve/CVE-2018-5767 The following is an actualization of CVE-2018-5767, a vulnerability which exploits an unguarded call to sscanf that occurs when parsing the 'Cookie' header for a password. The...

cve-2000-0649

CVE-2000-0649 for Apache CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server from the Location parameter in the respose header. Official details are here: Rapid7: https://www.rapid7.com/db/modules/auxiliary/scanner/http/iisinternalip/ CV...

CVE-2018-5767-AC9

Research and Author David Baker Article: Sometimes Exploits Need Patches Too! Working Through a Change of Address External link CVE-2018-5767-AC9 An implementation of a proof-of-concept for CVE-2018-5767 https://vulners.com/cve/CVE-2018-5767 The following is an actualization of CVE-2018-5767, a...

CVE-2023-4631

CVE ID : CVE-2023-4631 Vulnerability Type : IP Address Spoofing Description : The DoLogin Security plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 3.6. This is due to insufficient restrictions on where the IP Address information is being retrieved for...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & Arbitrary File Read This project is an environment for practicing and reproducing the local file inclusion vulnerability CVE-2019-5418 in Ruby on Rails. This vulnerability allows reading arbitrary files on the server through path traversal via the...