h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

wotop

Web sobre Protocolo WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introducción WOTOP es una herramienta...

CVE-2025-55315

CVE-2025-55315 Explotación de prueba de concepto para CVE-2025-55315 Contrabando de solicitudes HTTP en .NET. Demuestra cómo la codificación fragmentada chunked encoding mal interpretada permite a atacantes introducir solicitudes de contrabando a través de proxies y balanceadores de carga en...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/...

EUVD-2026-88367

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls...

SUSE CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2025-23167

CVE-2025-23167 – Exploit de contrabando de solicitudes HTTP en Node.js Exploit funcional para CVE-2025-23167, una vulnerabilidad de contrabando de solicitudes que afecta a las versiones de Node.js 20.x anteriores a v20.19.2. Este error permite una terminación incorrecta de cabeceras HTTP, lo que...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

DEBIAN-CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

CVE-2026-101906

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

The Axios promise-based HTTP client for the browser and Node.js is vulnerable in versions 1.13.0 through 1.20.0 . The HTTP/2 adapter fails to consistently apply configured proxy settings or caller-supplied DNS lookup policies during request setup. Specifically, an HTTPS request using httpVersion:...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Un análisis de la causa raíz de la vulnerabilidad se puede encontrar en mi blog:...

CVE-2025-22870

PoC – CVE-2025-22870 – HTTP Proxy Bypass via IPv6 Zone ID in Go Summary This Proof of Concept demonstrates the exploitation of CVE-2025-22870, a vulnerability in the golang.org/x/net/http/httpproxy package prior to v0.36.0, which can be used to bypass HTTP proxy restrictions by abusing the way IP...

vCenter Server - Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...

CTT-Enhanced-CVE-2026-46339-Exploit-Engine

CTT-Enhanced-CVE-2026-46339-Exploit-Engine Un framework especializado en Python que ejecuta ejecución remota de código no autenticada a través del puente del Model Context Protocol MCP de 9Router, implementando una cascada de fases temporales de 33 capas, dispersión de Riemann-Hadamard y un filtr...