87 matches found
CVE-2010-5301
CVE-2010-5301 ไปปๆใฎDLLใคใณใธใงใฏใทใงใณใไผดใSEHใชใผใใผใใญใผใฎๆฆๅฟตๅฎ่จผ๏ผPoC๏ผ ่ชฌๆ Kolibrรฌ HTTP Server 2.0ใฏใในใฟใใฏใใผในใฎใใใใกใชใผใใผใใญใผ ใฎๅฝฑ้ฟใๅใใพใใ็บ่ฆๅฝๆใใใฎ่ๅผฑๆงใฏใESPใในใฟใใฏไธใซ็ฝฎใใใใทใงใซใณใผใใๆใJMP ESPๅฝไปคใงๅฝไปคใใคใณใฟใๅ็ดใซไธๆธใใใใใจใงๆช็จใใใฆใใพใใใใใฎๅพใใใๅคงใใชใใคใญใผใใ้ไฟกใใใจSEHใใงใผใณใไธๆธใใงใใใใจใๅคๆใใพใใใใใ ใใใใฎใขใใชใฑใผใทใงใณใซใฏใSEใใณใใฉใๆฌกใฎSEHใฌใณใผใใธๅใใใใๆๅนใชPOP - POP -...
CVE-2026-48053
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
CVE-2026-48053
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
EUVD-2026-60319
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
CVE-2026-48053
Kolibri versions before 0.19.4 have an unauthenticated SSRF in RemoteFacilityUserViewset (api.py:1570) and three other endpoints: the baseurl parameter is only scheme-validated, and requests follows 30x redirects, allowing attackers to pivot fetches to internal services or cloud metadata (AWS IMD...
CVE-2026-48053: Server-Side Request Forgery (SSRF)
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...
PYSEC-2026-2554 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Summary Several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
SummarySeveral Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...
Server-side Request Forgery (SSRF)
Overview kolibri is a Kolibri - the offline app for universal education Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the baseurl parameter in several API endpoints, which is insufficiently validated and allows outbound HTTP requests to arbitrary hosts. ...
PT-2026-48808
Name of the Vulnerable Software and Affected Versions Kolibri versions prior to 0.19.4 Description Several API endpoints accept an unvalidated baseurl parameter, allowing the server to fetch attacker-controlled URLs and reflect the response body back to the caller. This occurs because the baseurl...
CVE-2026-48053
creationtimestamp| type| source ---|---|--- 2026-05-27 17:45:47+00:00| published-proof-of-concept| https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc...
Kolibri 2.0 Buffer Overflow
!/usr/bin/python3 Exploit Title: Kolibri GET request buffer Overflow Stack Egghunter Date: 2 Augst 2023 Exploit Author: Mahmoud NourEldin @Engacker Vendor App: https://www.exploit-db.com/apps/4d4e15b98e105facf94e4fd6a1f9eb78-Kolibri-2.0-win.zip Version: Kolibri 2.0 Tested on: Windows 10...
Malicious Package
Overview @kolonialno/kolibri-web is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
CVE-2014-5289
Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request...
Buffer overflow
Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request...
CVE-2014-5289
CVE-2014-5289 is a stack/remote buffer overflow in SENKAS Kolibri Webserver 2.0 where improper validation of input in HTTP POST handling allows a remote attacker to execute arbitrary code. Public reports (SAINT, EXPLOIT-DB, Seebug) describe a user-supplied long URI in POST requests as the trigger...