CVE-2025-24813

CVE-2025-24813 Proof of Concept PoC script for CVE-2025-24813, vulnerability in Apache Tomcat. The script has been modified based on the related link and tailored to my needs. Setup Vulnerable Tomcat Environment Given environment based on the official Tomcat 9.0.90 image. It removes the server's...

Tomcat-CVE-2025-24813

Conditions of Use DefaultServlet write function is enabled: it needs to web.xml be configured inreadonly=false Partial PUT request support: Tomcat supports block upload by default Enable file session persistence: need to context.xml configure PersistentManager and FileStore There is a...

CVE-2017-12615

curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Remote Code Execution Exploit This is a proof-of-concept PoC exploit for CVE-2025-24813 , a vulnerability in Apache Tomcat 9.0.80–9.0.83, 10.1.0–10.1.17 that allows remote code execution RCE via session deserialization. The exploit abuses partial PUT requests and th...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

CVE-2020-13768

🐞 CVE-2020-13768: MiniShare 1.4.1 - Stack-Based Buffer Overflow Stack-based buffer overflow in MiniShare 1.4.1 reachable through a single HTTP PUT request. 📑 Table of Contents Why this repository exists Why this vulnerability is interesting Context and affected software About the vulnerability...

JetBrains YouTrack < 2025.3.160480 / 2026.1.x < 2026.1.14047 Improper Access Control (CVE-2026-86498)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.160480, or 2026.1.x prior to 2026.1.14047. It is, therefore, affected by an improper access control vulnerability: - In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 PUT requests on link sub-resources allowe...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Rewrite Valve를 통한 디렉터리 보호 우회 → PUT 기반 RCE🚨🚨 요약 CVE-2025-55752는 버그 60013을 수정하는 과정에서 Apache Tomcat에 도입된 보안 회귀regression입니다. Rewrite Valve가 사용될 때 Tomcat은 URL 디코딩 전에 경로 정규화path normalization를 적용합니다. 이 잘못된 순서로 인해 조작된 URI가 /WEB-INF/ 및 /META-INF/와 같은 보호 경로에 대해...

cve-2019-6715

cve-2019-6715 Отдельное спасибо TomNomNom за 99.9% его кода.... Сборка root@kitploit: go get github.com/fatih/color go build Использование root@kitploit: cat list.txt | ./2019-6715 Все уязвимые URL записываются в text.log CVE 2019-6715 Описание: pub/sns.php в плагине W3 Total Cache версии ниже...

CVE-2023-3722

CVE-2023-3722 CVE-2023-3722 Avaya Aura Device Services 무제한 파일 업로드 RCE에 대한 Python POC입니다. 이 스크립트는 PUT 요청을 사용하여 8자리 무작위 생성 파일 이름으로 PHP 파일을 업로드합니다. 그런 다음 GET 요청을 통해 이 파일을 검색하고 출력을 파싱하여 명령 출력을 얻습니다. 실행 root@kitploit: python3 ./CVE-2023-3722.py example.com:444 --query "id" root@kitploit: python3...

CVE-2025-24813

Apache Tomcat RCE без аутентификации - CVE-2025-24813 Этот репозиторий предоставляет руководство и среду тестирования для оценки уязвимости CVE-2025-24813. Детали Затронутые версии: Apache Tomcat 11.0.0-M1 to 11.0.2 Apache Tomcat 10.1.0-M1 to 10.1.34 Apache Tomcat 9.0.0.M1 to 9.0.98 Ссылки...

CVE-2026-86498

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...

CVE-2026-86498

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...

EUVD-2026-72514

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...

EUVD-2026-69062

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

CVE-2026-30051

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

EUVD-2026-67106

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2026-30051

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2026-30051

CVE-2026-30051 affects the free5gc v4.1.0 open-source 5G core network implementation. The vulnerability resides in the CreateUEContextProcedure function, reachable at the API endpoint /v1/ue-contexts/{supi} . An unauthenticated remote attacker can cause a Denial of Service by sending a crafted PU...

CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...