CVE-2021-21975

CVE-2021-21975 SSRF-POC - SSRF 到凭据泄露 首先配置 pd 客户端。 现在运行 ./pd deploy http-new-requests 现在替换脚本中的 pipedream http 请求示例：Randomstring.m.pipedream.net 在一个单独的终端中运行 - ./pd logs new-requests | tee -a req.txt 然后在另一个终端中运行 - python3 CVE-2021-21975.py iplist cat req.txt | grep Basic basic.txt; cat basic.txt |...

CVE-2023-27163

CVE-2023-27163 これは CVE-2023-27163 のPoCです。これは request-baskets の v1.2.1 までに存在するSSRF脆弱性です。 この脆弱性により、攻撃者は /api/baskets/name を介して機密性の高いネットワークリソースにアクセスできます。 request-baskets には、ユーザーがリクエストを転送する別のサーバーを指定できる機能があります。 ここでの問題は、ユーザーがネットワーク内で閉じた内部アプリケーションなど、意図しないサービスも指定できることです。 使用方法 root@kitploit: $ python3...

CVE-2021-40438

CVE-2021-40438 Apache フォワードリクエスト CVE CVE-2021-40438: 巧妙に細工されたリクエストURIパスにより、modproxyがリモートユーザーによって選択されたオリジンサーバーにリクエストを転送する可能性があります。この問題はApache HTTP Server 2.4.48以前に影響します。 このCVEは、DoS攻撃において元のIPを偽装するために使用される可能性があります。 app.netlas.ioで脆弱なサーバーを検索: root@kitploit: cve.basescore:8 and geo.country:"RU" and...

CVE-2021-40438

CVE-2021-40438 リクエストの uri-path により、modproxy がリクエストをリモートユーザーが選択したオリジンサーバーへ転送する可能性があります。この問題は Apache HTTP Server 2.4.48 以前のバージョンに影響します。 攻撃者は、uri パスを含むリクエストを作成することでこの脆弱性を悪用でき、これにより modproxy は攻撃者が選択したオリジンサーバーへリクエストを転送します。Apache HTTP Server の modproxy コンポーネントは、Apache HTTP Server...

PT-2026-90518

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions

A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-Side Request Forgery SSRF, where the server is tricked int...

NPM: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

NPM: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECTREQUEST forwarding vulnerability discovered by ? in WordPress Npm qti-neon versions 1.0.0...

CVE-2026-44652

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into fetchurl, .... It only blocks circular...

capstone-poc

Capstone Proof of Concept 1. Create the UI using the run fu...

EUVD-2026-4809

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing ...

EUVD-2023-43661

Malicious code in bioql PyPI...

CVE-2025-47910

CVE-2025-47910 — Normal (detailed) The connected sources confirm a vulnerability in Go’s net/http CrossOriginProtection: the AddInsecureBypassPattern can bypass more requests than intended, causing CrossOriginProtection to skip validation while forwarding the original request path. This may allow...

CVE-2025-47910 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...

Google Go 安全漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from the AddInsecureBypassPattern method that may accidentally bypass more requests, resulting in skipping authenticati...

SUSE CVE-2025-47910

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...

CVE-2023-39967

WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...

Ubuntu: Security Advisory (USN-7161-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Incorrect Input Validation

Apache Traffic Server is vulnerable to Incorrect Input Validation. The vulnerability is caused due to Invalid Accept-Encoding header. This can lead to fail cache lookup and force forwarding requests...

CVE-2024-35296 Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

CVE-2024-0387

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...