CVE-2026-42356

The Apache HTTP Server versions 2.4.60 through 2.4.68 are affected by a deployment of wrong handler vulnerability (CVE-2026-42356). This flaw allows the target of certain internal redirects originating from CGI programs to be incorrectly treated as CGI and executed. For this to occur, the target ...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42356

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

EUVD-2026-90886

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

CVE-2026-42528

A memory calculation bug in the mod_dav module of Apache httpd version 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to trigger a crash in server child processes. This vulnerability is characterized as a mod_dav shared lock overflow . To mitigate this issue, users a...

CVE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

cve-2021-41773-source-code-analysis

Análisis del Código Fuente de CVE-2021-41773 en Apache HTTP Server Una herramienta de análisis estático de parches basada en Python para estudiar la causa raíz y la remediación de CVE-2021-41773 Path Traversal en Apache HTTP Server mediante la comparación del código fuente vulnerable de Apache HT...

CVE-2021-41773-apache

CVE-2021-41773 Exploit de Apache HTTP Server Este repositorio contiene un exploit de prueba de concepto basado en Python para la vulnerabilidad de path traversal del servidor Apache HTTP identificada como CVE-2021-41773. El script está diseñado para investigación de seguridad, pruebas defensivas ...

Myesve

myesve CVE-2024-38475 Exploitation Framework – Version 1.0 Disclaimer: This tool is intended for authorized security testing, educational research, and legitimate bug bounty programs only. Do not use it against systems you do not own or lack explicit permission to test. The authors assume no...

EP3_Redes

EP3Redes Implementaciones de servidores HTML en GO para análisis de la vulnerabilidad CVE-2023-29406...

CVE-2024-40898-SSL-Bypass-Detection

CVE-2024-40898 Escáner de omisión de validación de certificados SSL Este repositorio contiene un script de prueba de concepto PoC basado en Python para detectar CVE-2024-40898, una vulnerabilidad en Apache HTTP Server que permite a los atacantes omitir la verificación de certificados SSL...

CVE-2020-35667-PoC

CVE-2020-35667-PoC Resumen AVISO El comportamiento vulnerable ilustrado a continuación fue verificado empíricamente a partir de artefactos descompilados y parcheados, que intentan asemejarse a la vulnerabilidad original inferida con un enfoque heurístico, dado que la versión original vulnerable d...

CVE-2021-42013-EXPLOIT

🚨 CVE-2021-42013 - Apache 2.4.49 & 2.4.50 Remote Code Execution 🚨 CVE-2021-42013 builds upon the previously identified vulnerability, CVE-2021-41773. Despite the Apache team's efforts to address CVE-2021-41773 in version 2.4.50, subsequent investigations revealed that the fix fell short of fully...

CVE-2021-40438

CVE-2021-40438 Una uri-path de solicitud puede hacer que modproxy reenvíe la solicitud al servidor de origen elegido por el usuario remoto. Este problema afecta a Apache HTTP Server 2.4.48 y versiones anteriores. Un atacante puede explotar esta vulnerabilidad creando solicitudes con una uri-path,...

cve-2021-41773

CVE-2021-41773 CVE-2021-41773: Vulnerabilidad de día cero de Path Traversal explotada en Apache HTTP Server Apache HTTP Server CVE-2021-41773 explotado activamente en ataques reales CVE-2021-42013: Path Traversal y ejecución remota de código en Apache HTTP Server 2.4.49 y 2.4.50 corrección...

cve-2021-41773-docker-lab

Laboratorio CVE-2021-41773 Laboratorio en contenedor para jugar/aprender con CVE-2021-41773 Divulgación de archivos: $ docker build -t apache-default defaultconf $ docker run -dit --name apache-app -p 81:80 apache-default PoC curl -s --path-as-is...

CVE-2021-42013

Escáner de Vulnerabilidades Apache CVE-2021-41773 / CVE-2021-42013 Un escáner integral de vulnerabilidades basado en Python para detectar las vulnerabilidades de path traversal y ejecución remota de código CVE-2021-41773 y CVE-2021-42013 en Apache HTTP Server versiones 2.4.49 y 2.4.50. Descripció...

CVE-2021-41773

CVE-2021-41773 - Ejecución Remota de Código en Apache 2.4.49 PoC para CVE-2021-41773 ya que encontré exploits demasiado complicados y este va directo a la Ejecución Remota de Código. Uso Simplemente especifica la dirección IP que ejecuta el servidor vulnerable Apache 2.4.49 con -i y el comando de...