Log4Shell-CVE-2021-44228-Demo

Démo Log4Shell CVE-2021-44228 Configuration de l'environnement Client N'importe où avec la capacité d'accéder au serveur HTTP via la ligne de commande curl Application vulnérable via le serveur HTTP avec log4j Instance EC2 Amazon Linux 2 basé sur x86 / Machine virtuelle CentOS Azure $ yum install...

cpx_proftpd

cpxproftpd PoC par Daniel Aldana pour l'exploitation de CVE-2015-3306. Bogue signalé par Vadim Melihow. MÉTHODE 1 : utilisation : python cpxproftp.py ex : python cpxproftp.py 127.0.0.1 /etc/passwd /var/www/pass.txt puis essayez : http://127.0.0.1/pass.txt MÉTHODE 2 : utilisation : python...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105648

The Ghost Node.js content management system is vulnerable to a validation issue in versions 6.0.9 through 6.65.0 . An unauthenticated user can abuse certain functionalities, such as Webmentions , to perform limited HTTP requests to hosts within the server's internal network on specific network co...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105647

The Ghost Node.js content management system is vulnerable to a Server-Side Request Forgery (SSRF) issue in versions 6.54.1 through 6.65.0 . A validation issue allows an unauthenticated user to abuse specific functionalities, such as Webmentions , to perform limited HTTP requests to hosts within t...

CVE-2021-41773

CVE-2021-41773 C'est la première fois que j'essaie de créer un exploit pour quelque chose alors... soyez gentil 😁 Exploit Title: Apache HTTP Server 2.4.49 Path Traversal Author: 0xRar , 0xrar.net CVE: CVE-2021-41773 Version: Apache 2.4.49 Not Tested Yet Commande d'aide : python3 exploit.py -h...

CVE-2026-20253

CVE-2026-20253 — Лаборатория Pre-Auth RCE для Splunk Enterprise Создание и усечение произвольных файлов без аутентификации через сайдкар PostgreSQL CVSS 9.8 · Критическая · CWE-306 · Активно эксплуатируется CISA KEV ⚠️ Отказ от ответственности Этот репозиторий предназначен строго для...

mass_cve-2021-41773

masscve-2021-41773 МАССОВЫЙ CVE-2021-41773 Скриншот Использование ! python3 -m pip install requests pyyhon3 cve-2021-41773.py urlist.txt pool Примечание ! результаты будут автоматически сохранены в vuln.txt вы можете добавить общий каталог на...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Участники Ли Хи Су @lheeeesoo Apache HTTP Server 2.4.49 содержит уязвимость: в процессе нормализации URL-путей сервер не блокирует должным образом закодированные пути верхнего уровня. Используя такие значения, как .%2e, атакующий может выйти за...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-105636

The project management tool Plane is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The flaw exists in the webhook delivery task within apps/api/plane/bgtasks/webhook_task.py, where requests.post() is called without setting allow_redirects=False. While the applicati...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 Согласно данным Национальной базы данных уязвимостей NVD CVE-2021-41773, Apache HTTP Server 2.4.49 уязвим для атак типа обхода пути и удалённого выполнения кода. Обход пути Уязвимость обхода пути была внесена из-за нового изменения кода, добавленного для нормализации...

RCE_CVE-2024-7954-

RCECVE-2024-7954- Le plugin porteplume utilisé par SPIP avant les versions 4.30-alpha2, 4.2.13 et 4.1.16 est vulnérable à une exécution de code arbitraire. Un attaquant distant non authentifié peut exécuter du PHP arbitraire en tant qu'utilisateur SPIP en envoyant une requête HTTP malveillante...