CVE-2024-10914

CVE-2024-10914 - Exploit de Ejecución Remota de Código RCE en D-Link Este script es un exploit de prueba de concepto PoC para CVE-2024-10914, una vulnerabilidad de ejecución remota de código en ciertos dispositivos D-Link. El script identifica y explota dispositivos vulnerables para ejecutar...

lighty-sqlinj-demo

title: Ep4 - Network-Related Vulnerability members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Related vulnerability: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Confirm:...

CVE-2024-10914

CVE-2024-10914 - Exploit de Ejecución Remota de Código RCE en D-Link Este script es un exploit de prueba de concepto PoC para CVE-2024-10914, una vulnerabilidad de ejecución remota de código en ciertos dispositivos D-Link. El script identifica y explota dispositivos vulnerables para ejecutar...

uc_httpd_exploit

uc httpd exploit lighthttpd Exploit simple de uc httpd hecho con py3.. este exploit fue escrito a partir de CVE-2014-2324 Descripción Múltiples vulnerabilidades de salto de directorio en 1 modevhost y 2 modsimplevhost en lighttpd anteriores a 1.4.35 permiten a atacantes remotos leer archivos...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...

Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

Lighttpd 1.4.34 SQL Injection and Path Traversal

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical...

CVE-2024-10914

CVE-2024-10914 Prueba de Vulnerabilidad de Inyección de Comandos para D-Link NASManual testing with burpsuite Dork para encontrar dispositivos vulnerables Utilice el siguiente dork de búsqueda para encontrar dispositivos D-Link NAS potencialmente vulnerables: FOFA: app="DLink-DNS-ShareCenter" &&...

CVE-2022-30780-lighttpd-denial-of-service

CVE-2022-30780 - lighttpd remote denial of service CVE-2022-30780 - lighttpd remote denial of service Summary An unauthenticated attacker can send an HTTP request with an URL overflowing the maximum URL length, resulting in a denial of service. Vulnerable versions The following versions of lightt...

zyxel-wax650s-research-notebook-public

Zyxel WAX650S Research Notebook Public-safe research notebook for Zyxel WAX650S firmware V7.10ABRM.4C0. This repo is written as a story-format wiki for researchers and future LLM-assisted follow-up work. It captures how the lab was brought up, which findings were confirmed, which chains failed, a...

CVE-2022-30780_Checker

CVE-2022-30780 - lighttpd remote denial of service Description Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service CPU consumption from stuck connections because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on...

CVE-2026-100669

Grav versions before 2.0.25 ship web server configuration samples with case-sensitive deny rules, leading to sensitive file disclosure . In webserver-configs/web.config (IIS), the ignoreCase="false" setting on URL Rewrite elements allows unauthenticated remote attackers to bypass access controls ...

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754

CVE-2026-18754 affects GV-AS1620 Controller Firmware (GV-Cloud). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. The exposed private key can compromise HTTPS confidentiality and integrity, enabling traffic decryption and potential ser...

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...