CVE-2021-44228

CVE-2021-44228 Usando la librería Log4j 2.14 Vulnerable en User-Agent, método POST y punto de entrada /admin/cores?foo= Lo he subido a Docker Hub: puedes hacer pull y ejecutarlo https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

WTSRM2

WTSRM2 This is a continuation to my original project WTSRM and the corresponding talk. This project was re-written in order to utilize C++17 in order to create a template that allows us to change the required functionality at compile time with ease! This is implemented as a header only file such...

CVE-2025-29927

CVE-2025-29927 Reproducción y corrección de la vulnerabilidad CVE-2025-29927. git clone [email protected]:Bongni/CVE-2025-29927.git cd CVE-2025-29927 En vulnerable/ hay una versión de la aplicación que es vulnerable al ataque. En fixed/ hay una versión de la aplicación que está actualizada a...

CVE-2026-14840

CVE-2026-14840 — YOP Poll 7.0.6 Vote Limit Bypass Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? YOP Poll plugin versions 7.0.6 enforce a one-vote-per-IP limit. The problem is that to obtain the client IP it checks HTTPCLIENTIP and...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Description A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM CVSS 10.0, allowing unauthenticat...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2020-27223

CVE-2020-27223 Uso $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 Corregido $...

TBK DVR4104/DVR4216 Devices - Authentication Bypass

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

CVE-2026-63292

⚠️ CVE-2026-63292 — Apache HTTP Server Security Vulnerability 🔐 --- 🔎 Overview CVE-2026-63292 is a stack-based buffer overflow vulnerability affecting the Apache HTTP Server modvhostalias module. The issue can be triggered under specific server configurations involving oversized HTTP Host headers...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Prueba de Concepto POC por CRFSlick, descubierto por AkkuS Se descubrió un problema en CutePHP CuteNews 2.1.2. Un atacante puede infiltrarse en el servidor mediante el proceso de carga de avatar en el área de perfil a través del campo avatarfile hacia...

CVE-2014-6271-Apache-Debian

CVE-2014-6271-Apache-Debian Resumen Este repositorio es un entorno PoC de CVE-2014-6271. Puede desplegar un servicio web que incluye la vulnerabilidad utilizando la imagen de contenedor apache2. Preparación Construcción de la imagen Construya la imagen insegura desde el Dockerfile. docker build -...

cve-2025-24035-rds-websocket-dos-test

CVE-2025-24035 Prueba de Estrés WebSocket Seguro 🚨 DESCARGO DE RESPONSABILIDAD : Esto NO es un exploit. Este script es una simulación y solo debe utilizarse con fines educativos en un entorno de laboratorio seguro. Propósito Esta prueba envía deliberadamente un encabezado WebSocket de tamaño...

EUVD-2026-76105

Headroom vulnerable to Cross-Site WebSocket Hijacking CSWSH...

cve-2025-29927

CVE-2025-29927 1. ve a /api/flag 2. añade x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware como encabezado 3. ve la respuesta...

cve-2026-19900-PoC

CVE-2026-19900 LB-LINK X-PRO Authentication Bypass and RCE via null user CVE-2026-19900 Hardcored Credential and Authentication Bypass RCE via null user. Bypass via Header: Cookie:user=null Usage Build and run the script with a target host: go build cve-2026-19900-PoC.go ./cve-2026-19900-PoC -t...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Una vulnerabilidad en la biblioteca de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto no autenticado vuelva a firmar tokens utilizando una clave incrustada dentro del token. La vulnerabilidad se debe a que node-jose sigu...

CVE-2026-48710

CVE-2026-48710 Principle: Starlette is an open-source, lightweight Python ASGI framework. The root cause is that when processing URL data structures, Starlette trusts the host sent by the client and directly concatenates it into the url variable for subsequent authentication handling. The raw URL...

EUVD-2026-44819

Anubis: Policy bypass via client controlled X-Original-URI header...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...