SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Remote Code Execution via Log File System Setting and Log File Poisioning Overview I recently discovered two vulnerabilities in SuiteCRM that provides an attack chain for a low privileged user to achieve code execution on the underlying operating system. The attack chain i...

CVE-2023-27163

PoC of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and sensitive...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our te...

CVE-2021-26855_SSRF

CVE-2021-26855SSRF CVE-2021-26855 Exchange SSRF POC change the ceye.io tokne & Identifier : token = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' dnsurl = randomstr + '.XXXXXX.ceye.io' python CVE-2021-26855SSRF.py https://a.com...

CVE-2019-12384

CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 CSRF Vulnerability: Leads to Creating Fake Clients Project Name & Repo URL : https://phpgurukul.com/client-management-system-using-php-mysql/ Vulnerability Name : Cross-Site Request ForgeryCSRF Affected Version : V1.2 Introduction A Cross-Site Request Forgery CSRF vulnerability...

gitlab-cve-2021-22214

gitlab-cve-2021-22214 Gitlab SSRF Follow us Vulnmachines YouTube Twitter Facebook LinkedIn...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80...

CVE-2020-23585

CVE-2020-23585 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" A remote attacker can conduct a cross-site request forgery CSRF attack on "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028". The vulnerability...

CVE-2021-24085

Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...

CVE-2024-57373

CSRF Vulnerability in LifestyleStore v1.0 📌 Overview This repository documents a Cross-Site Request Forgery CSRF vulnerability identified in the LifestyleStore v1.0 project. The flaw allows attackers to perform unauthorized actions on behalf of authenticated users, posing risks to data integrity...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Welcome to the official repository documenting the discovery and details of CVE-2025-26206 , a critical Cross-Site Request Forgery CSRF vulnerability in Sell Done Storefront v.1.0. Discovered by B. Sibhi , this...

CVE-2020-23586

CVE-2020-23586 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" vulnerability found in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028"which allows an unauthenticated, remote attacker to conduct a...

WebLogic-SSRF_CVE-2014-4210

WebLogic-SSRFCVE-2014-4210 Weblogic SearchPublicRegistries SSRFCVE-2014-4210 Exploit Script based on Python3 Usage optional arguments: -h, --help show this help message and exit -u U Single Target URL -uf UF Read URLs from file -p P Only scan specified ports -sn SN Only scan specified subnets -sf...

CVE-2025-22963

Overview Cross-site request forgeryCSRF vulnerability in Teedy versions = v1.11 allows remote attackers to force an end user to change their user informationusername, password, etc... on the web application in which they're currently authenticated. Vulnerability User information change endpoint i...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

CVE-2024-5736

CVE-2024-5736 AdmirorFrames Joomla! Extension 5.0 - Server-Side Request Forgery Timeline Vulnerability reported to vendor: 26.01.2024 New fixed 5.0 version released: 06.06.2024 Public disclosure: 28.06.2024 Description Server-Side Request Forgery in AdmirorFrames Joomla! Extension in afGdStream.p...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 SSRF simple exploitation golang practice Affected Versions Exchange Server 2013 earlier than CU23 Exchange Server 2016 earlier than CU18 Exchange Server 2019 earlier than CU7 Exploitation Conditions This vulnerability is different from previous Exchange...