CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-4253-Scanner

CVE-2026-42530 — Escáner Safe-Check Escáner masivo no destructivo para el use-after-free de NGINX HTTP/3 QUIC Inventario de qué hosts están expuestos — sin desencadenar el fallo. ⚠️ Aviso legal Esta herramienta es solo para pruebas de seguridad autorizadas — tu propia infraestructura o sistemas...

heartbleed-vulnerability-exploitation

heartbleed-vulnerability-exploitation Description hands on investigation of the Heartbleed vulnerability CVE-2014-0160. Summary this lab documents a hands-on investigation of the Heartbleed vulnerability, a critical flaw in OpenSSL's implementation of the TLS heartbeat extension. the goal was to...

CVE-2026-9256-POC

CVE-2026-9256-POC CVE-2026-9256 Nginx heap buffer overflow POC...

CVE-2026-42945

CVE-2026-42945 — NGINX Rift Desbordamiento de búfer en el montón en NGINXngxhttprewritemodule Métrica| Valor ---|--- CVSS v4.0| 9.2 Crítico CVSS v3.1| 8.1 Alto — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| 122 — Desbordamiento de búfer basado en montón Introducido| Junio 2008 — v0.6.27 Descubierto|...

CVE-2024-24945-NGINX-RIFT---TryHackMe-Lab-Walkthrough

CVE-2024-24945-NGINX-RIFT---TryHackMe-Lab-Walkthrough This lab demonstrates the exploitation of CVE-2024-24945, a heap corruption vulnerability affecting NGINX. The objective was to understand how memory corruption can lead to Remote Code Execution RCE and gain practical experience in exploitatio...

CVE-2026-61628

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 — lucasdillmann nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates...

cve-2017-7529

CVE-2017-7529 Esto es parte de Cved: una herramienta para gestionar contenedores Docker vulnerables. Cved: https://github.com/git-rep-src/cved Fuente de la imagen: https://github.com/cved-sources/cve-2017-7529 Autor de la imagen: https://github.com/Medicean/VulApps/tree/master/n/nginx/1...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

Nginx_cve-2026-42945-scanner-gui

Ngxin cve-2026-42945-scanner-gui a need run jdk21version java -jar cve-2026-42945-scanner.... Bulk scanning + one-click vulnerability exploitation Requires JDK 21 to run After extraction, java -jar cve-2026-42945-scanner.... Bulk scanning + one-click vulnerability exploitation...

CVE-2026-42945-Reverse-Shell-POC

CVE-2026-42945 NGINX Rift RCE PoC with Reverse Shell Remote code execution proof-of-concept for CVE-2026-42945 , a heap buffer overflow in NGINX's ngxhttprewritemodule. This fork extends the public trigger PoC with an embedded reverse-shell listener and configurable exploitation parameters for CT...

CVE-2026-9256-Poc

nginx ngxhttprewritemodule Heap Buffer Overflow Description nginx Plus and nginx Open Source ngxhttprewritemodule contains a heap buffer overflow vulnerability. When a rewrite directive uses a regex with multiple overlapping PCRE capture groups e.g. ^/.$ and a replacement referencing multiple...

CVE-2026-9256

CVE-2026-9256 — sitio de seguimiento del desbordamiento de montón del módulo rewrite de nginx Fuente del rastreador de estado del parche CVE-2026-9256: un sitio de una sola página que registra qué distribuciones han publicado una corrección para el desbordamiento de montón del módulo rewrite de...

cve-2025-29927-poc

CVE-2025-29927-POC Introduction This repository contains a Proof of Concept PoC for CVE-2025-29927, a hypothetical vulnerability demonstrating a flaw in middleware handling within a web application. The PoC illustrates how a specially crafted HTTP request can bypass redirection logic to access...

CVE-2025-5961

CVE-2025-5961 Migration, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

CVE-2019-11043

CVE-2019-11043 Descripción de la vulnerabilidad En Nginx, al procesar peticiones con %0a en fastcgisplitpathinfo, el salto de línea \n provoca que PATHINFO quede vacío. Por otro lado, php-fpm tiene un defecto lógico al manejar PATHINFO vacío. Un atacante puede lograr ejecución remota de código...

ctf-cve-2019-11043

Task Management APP CVE-2019-11043 Lab Minimal PHP app with intentionally vulnerable Nginx/PHP-FPM setup for reproducing CVE-2019-11043. Includes a tiny task manager, login/admin, and DB config UI. Build & Run Docker root@kitploit: build docker build -t cve-2019-11043-lab:app . run docker run --r...

CVE-2026-23813

CVE-2026-23813 — Omisión de Autenticación Pre-Auth en AOS-CX Atacantes remotos no autenticados pueden alcanzar la API REST de gestión de AOS-CX contrabandeando un token login a través de la expresión regular demasiado permisiva de nginx sobre versiones, exponiendo la superficie de configuración...

CVE-2026-42530

CVE-2026-42530 Scanner para CVE-2026-42530, un uso después de liberar en el módulo HTTP/3 de nginx. Afectado: nginx 1.31.0, 1.31.1 Corregido: nginx 1.31.2 Uso root@kitploit: pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt Cómo funciona...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Kit de herramientas para la vulnerabilidad Rift de Nginx Kit de herramientas integral para escanear, parchar y probar CVE-2026-42945, una vulnerabilidad crítica de ejecución remota de código en nginx Tabla de Contenidos Resumen Detalles de CVE Características Componentes del kit...