poc_proxylogon

pocproxylogon Microsoft Exchange ProxyLogon PoC（CVE-2021-26855） このスクリプトは元々celesianによってこのCVEを悪用するために作成されました。 その後、SSRFに対して脆弱なExchangeサーバーを悪用するように更新しましたが、EWS機能を利用してシェルを取得します。なぜなら、クライアント企業が/ecp/DDI/DDIService.svc/機能を無効化してExchangeサーバーにパッチを当てたからです（笑）。...

EUVD-2026-69724

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations...

CVE-2025-10377

CVE-2025-10377 概念验证：插件系统仪表盘中的跨站请求伪造（CSRF）（函数 sdtogglelogs） 漏洞类型： 跨站请求伪造（CSRF） 受影响函数： sdtogglelogs CVSS v3.1： 4.3（中危） 向量： AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N （注：评分反映的是需要管理员受害者与用户交互的未授权状态变更。） 漏洞描述： 函数 sdtogglelogs 处理敏感操作，例如启用/禁用页面访问日志、错误日志和邮件投递日志。然而，它仅依赖于 $REQUEST'logtype' 参数和权限检查 currentusercan...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary クロスサイトリクエストフォージェリ 特権昇格の脆弱性 これはCVE-2021-24085の概念実証です。 1. poc.py は、内部に秘密鍵を含むターゲットの証明書ファイルをダウンロードします。 2. YellowCanary は、SIDに基づいて特定のユーザーのmsExchEcpCanary CSRFトークンを生成します。 3. poc.js は、アカウント乗っ取りを引き起こすCSRFエクスプロイトです。...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allowed remote code execution on the instance. The root cause was insufficient network isolation that permitted malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests ...

EUVD-2026-55971

TYPO3 CMS - Broken Access Control in Backend and Install Tool...

CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

CVE-2025-67315

CSRF による任意従業員の無効化 概要 従業員管理 機能にはクロスサイトリクエストフォージェリ CSRF の脆弱性があります。 攻撃者はログイン済みの管理者をだまして、管理者の知らないうちに同意なく従業員（例：inid=1）を無効化する偽装リクエストを送信させることができます。 CVSS 基本スコア: 5.4（MEDIUM） ベクトル文字列: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L 影響を受ける機能 モジュール: 管理パネル → 従業員 → 従業員管理 アクション: 従業員の無効化（inid パラメータ経由） 再現手順 1...

ssrfnginx

ssrfnginx...

EUVD-2026-69643

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-73757

CVE-2026-73757 is an authenticated SSRF vulnerability in the web-based management interface of HPE AOS-CX . A remote attacker with valid credentials can forge server-side requests to enumerate the internal structure of the host, resulting in potential disclosure and limited modification of sensit...

EUVD-2026-69621

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery SSRF attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential...

CVE-2021-24901

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:56+00:00| seen| https://t.me/hackingAttack/42050 2026-09-02 01:02:17+00:00| seen| https://t.me/hackingAttack/42050...

CVE-2026-8712 Wyoming < 1.10.2 SSRF via uri Query Parameter

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...

EUVD-2026-69283

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18780

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions V.4 through before V.16 . The vulnerability allows an attacker to forge requests on behalf of an authenticated user, resulting in a High i...

CVE-2026-83595

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

EUVD-2026-69033

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...