CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 エクスプロイト PoC 概要 このリポジトリには、WordPress の CVE-2023-22622 脆弱性を悪用し、WP-Cron を介してサービス拒否 DoS を引き起こすスクリプトが含まれています。このスクリプトを使用して、脆弱な WordPress サイトに大量のリクエストを送信し、サーバー過負荷を引き起こす可能性があります。 エクスプロイトの詳細 エクスプロイトタイトル: DoS WP-Cron - CVE-2023-22622 日付: 07/29/2024 エクスプロイト作成者: Michael Fry...

HttpStrike

HttpStrike 一个用 Python 编写的快速 DDoS 脚本，如果你增加请求数量，它会按照你的意愿发送大量 GET 请求。...

CVE-2023-44487-

CVE-2023-44487- 1- 安装 Go。 2- 在一台独立的机器上运行服务器（server.go 文件） 3- 在另一台独立的机器上执行 main.go 文件。注意：main.go 包含攻击代码。 4. 指定目标的 IP 地址。 5- 定义请求数量：运行 main.go -requests 5000。...

CVE-2004-0789-DDOS

root@kitploit: sudo python3 exploit.py Enter the DNS server IP address: IP Enter the number of requests to send: NUMBER...

CVE-2025-31650

Apache Tomcat 10.1.39 - サービス拒否 DoS このツールは、不正な priority ヘッダーを使用した大規模な非同期HTTP/2リクエストフラッドを実行して、バージョン10.1.10から10.1.39までを実行しているApache Tomcatサーバーの安定性をテストします。 ⚠️ これは厳密に教育および研究目的 のみです。 ❌ 著者は、違法または無許可の使用について一切責任を負いません 。 🧰 機能 ランダム化された不正なHTTP/2 priority ヘッダーを送信 マルチスレッド非同期アーキテクチャ httpx リアルタイムの可用性監視...

CVE-2026-86452

MISP versions ≤2.5.45 are affected by a vulnerability in unauthenticated mail endpoints, specifically the forgot password-reset and API-access request paths. The root cause is the absence of input length bounds, format validation, and rate limiting on these anonymous request paths, allowing an at...

CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

CVE-2026-86452 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or...

AZL-99384 CVE-2026-78662 affecting package telegraf 1.31.0-31

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

EUVD-2026-70266

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

GO-2026-6354 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

DEBIAN-CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

EUVD-2026-38171

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/ endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid...

CVE-2026-29606

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...

EUVD-2024-45395

Malicious code in bioql PyPI...

CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

CVE-2025-2586

A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk...

Informatica: No rate limiting on form[register]

The vulnerability overview is as follows: There was a lack of rate limiting on the formregister endpoint, allowing an attacker to send a large number of requests to the server in rapid succession without any restrictions. This could potentially have led to accelerated service usage and resource...

DNS Servers Request Flooding Denial of Service

Remote attackers may rapidly send a large number of DNS requests to the server within a short period of time. Successful exploitation may cause the server to crash, resulting in a denial of service condition...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...