CVE-2026-102296

ZoneMinder versions before 1.38.4 are vulnerable to static buffer overflow vulnerabilities within the RemoteCameraHttp::GetResponse() function. An attacker, such as a malicious HTTP camera or an intercepting party, can trigger these overflows by sending crafted HTTP responses containing oversized...

hsecscan

hsecscan 一个用于HTTP响应头的安全扫描器。 要求 Python 2.x Python 模块 os.path argparse sqlite3 urlparse urllib2 urllib json ssl 安装 $ pip install hsecscan 使用 $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROXY -a A security scanner for HTTP response headers...

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability. If you want to understand exactly how this vulnerability works, you can read the original researchers excellent article here This template is pretty straight forward. It does two...

zeek-netsupport-detector

NetSupport Contexto https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/ PCAP de prueba: https://app.any.run/tasks/b5d9853f-0dca-45ef-9532-83feeedcbf42 Ejemplo: $ zeek -Cr b5d9853f-0dca-45ef-9532-83feeedcbf42.pcap $ cat notice.log separator \x09 setseparator ,...

struts2_cve-2017-5638

struts2cve-2017-5638 Esto es una especie de porting a Java del exploit en Python disponible en: https://www.exploit-db.com/exploits/41570/. Este software está escrito para no tener dependencias externas. AVISO LEGAL Esta herramienta está pensada para ingenieros de seguridad y personal de appsec...

CVE-2025-29927-Nextjs-Bypass-PoC

PoC: CVE-2025-29927 - Bypass de Middleware en Next.js Este repositorio contiene una Prueba de Concepto PoC que demuestra cómo eludir las comprobaciones de seguridad del middleware en Next.js v13.5.6 explotando una vulnerabilidad relacionada con cabeceras HTTP internas. Resumen de la Vulnerabilida...

cve-2023-3519-citrix-scanner

cve-2023-3519-citrix-scanner Este script es un escáner básico de Citrix para CVE-2023-3519. Intentamos identificar Citrix Gateways/ADCs vulnerables observando las cabeceras HTTP. Cómo funciona Durante nuestro análisis de esta vulnerabilidad, nosotros y nuestros amigos de CERT-Verbund notamos que...

CVE-2024-24549

Apache Tomcat DoS Exploit CVE-2024-24549 Descripción Este repositorio contiene un exploit de prueba de concepto PoC para un ataque de denegación de servicio DoS contra Apache Tomcat versión 9.0.83 , basado en un problema identificado en el manejo de encabezados HTTP y cargas útiles. Este script...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

CVE-2017-12542-Exploit

Bypass de autenticación de HP iLO CVE-2017-12542 Este repositorio contiene un exploit de prueba de concepto para CVE-2017-12542 , una vulnerabilidad de bypass de autenticación que afecta a ciertas versiones del firmware de HP Integrated Lights-Out iLO. La vulnerabilidad permite acceso no...

CVE-2026-21710

CVE-2026-21710 — DoS en req.headersDistinct de Node.js Resumen Campo| Valor ---|--- ID CVE| CVE-2026-21710 Publicado| 2026-03-30 CVSS v3.1| 7.5 ALTO AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-770 — Asignación de recursos sin límites ni limitación Afectados| Node.js 20.x, 22.x, 24.x, 25.x...

log4j2-CVE-2021-45046

Aplicación vulnerable de muestra Log4j2 CVE-2021-45046 Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.15.0 Esta aplicación se basa en una aplicación web Spring Boot vulnerable a CVE-2021-45046 Utiliza Log4j 2.14.1 a través de spring-boot-starter-log4j2 2.6.1. Ejecución de la...

L4sh

Exploit RCE Log4Shell Exploit totalmente independiente que no requiere binarios de terceros. El exploit distribuye el payload a todos los encabezados HTTP registrados posibles, como X-Forwarding , Server-IP , User-Agent Uso python main.py -i lhost -u http://target:targetport -c "commandtoexecute"...

cve-2016-5699-jinzheng-sha

cve-2016-5699-report Reading Course Report This repo references an example. simple-client.py is a Python script to make HTTP requests to the URL passed from a command argument. simple-server.py uses Flask to construct a simple HTTP server to print the headers of received requests. Set Up Install...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw exists in the Conditional OTP authenticator of Keycloak , an identity and access management solution. The system improperly evaluates specific HTTP headers to decide whether to skip a one-time password (OTP) without verifying if those headers originate from a trusted source . Consequently,...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2014-6271

CVE-2014-6271 Shellshock Exploit en Python Una implementación limpia, eficiente e interactiva en Python diseñada para probar la vulnerabilidad Shellshock CVE-2014-6271 mediante inyección de variables de entorno HTTP. 📝 Descripción Shellshock CVE-2014-6271 es una vulnerabilidad crítica de segurida...

CVE-2026-96445: Improper Authentication

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...