security-research

Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 46 CVEs across 15 projects , 2023 to 2026. Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and...

CVE-2024-21893.py

CVE-2024-21893 Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x और Ivanti Neurons for ZTA के SAML घटक में एक सर्वर-साइड अनुरोध जालसाजी भेद्यता है जो एक हमलावर को बिना प्रमाणीकरण के कुछ प्रतिबंधित संसाधनों तक पहुंचने की अनुमति देती है। चलाएँ python CVE-2024-21893.py -u target.com -a...

CVE-2023-27163

Request-Baskets पर SSRF का PoC CVE-2023-27163 इस रिपॉजिटरी में CVE-2023-27163 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC शामिल है, जो request-baskets में संस्करण 1.2.1 तक पाई गई एक सर्वर-साइड रिक्वेस्ट फोर्जरी SSRF कमजोरी है। यह कमजोरी हमलावरों को एक क्राफ्टेड API अनुरोध के माध्यम से /api/baskets/name घटक ...

Microsoft_Exchange_Server_SSRF_CVE-2021-26855

MicrosoftExchangeServerSSRFCVE-2021-26855 zoomeye dork: app:"Microsoft Exchange Server" Скрипт MicrosoftExchangeServerSSRFCVE-2021-26855.py, написанный с использованием набора инструментов Seebug и pocsuite3, использовался для проверки данных за последний год: Доля успешных проверок: примерно 150...

Xstream-1.4.17

Xstream-1.4.17 ऊपर दिया गया Xstream डेमो वातावरण मेरे द्वारा स्थापित किया गया है, शोषण वातावरण JDK1.8u131 पर आधारित है, वर्तमान में स्थानीय परीक्षण और HTTP रिमोट पैकेट भेजने का समर्थन करता है XSTREAM=1.4.17 भेद्यता पुनरुत्पादन CVE-2021-39141, CVE-2021-39144, CVE-2021-39150, CVE-2021-39152 यह प्रय...

SSRF-Testing

मैं Tuta से प्राप्त समर्थन के लिए आभारी हूँ SSRF Server Side Request Forgery परीक्षण संसाधन त्वरित URL-आधारित बायपास: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

Havoc-C2-SSRF-poc

CVE-2024-41570: Havoc-C2-SSRF-poc Questa vulnerabilità viene sfruttata falsificando la registrazione e i check-in di un agente demon per aprire un socket TCP sul teamserver e leggere/scrivere dati da esso. Ciò consente agli attaccanti di far trapelare gli IP di origine dei teamserver e molto altr...

CVE-2019-12384

CVE-2019-12384 Jackson RCE und SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...

CVE-2024-27954

⚠️ CVE-2024-27954 💀 Automatic Remote code Execution Exploit Tools | Von GhostSec 💀 📝 Beschreibung Unzureichende Einschränkung eines Pfadnamens auf ein eingeschränktes Verzeichnis „Path Traversal“-Sicherheitslücke in WP Automatic Automatic ermöglicht Path Traversal und Server-Seitige Request...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Descrizione CVE-2024-47066 : Lobe Chat è un framework di chat di intelligenza artificiale open-source. Prima della versione 1.19.13, la protezione contro la server-side request forgery implementata in src/app/api/proxy/route.ts non considera i...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

ProxyLogon-CVE-2021-26855-metasploit

ProxyLogon-CVE-2021-26855-metasploit CVE-2021-26855 ProxyLogon Exchange SSRF zu beliebigem Dateischreiben Metasploit-Exploit-Skript Vorbereitung root@kitploit: git clone https://github.com/TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit cd ProxyLogon-CVE-2021-26855-metasploit mkdir -p...

Web-Security-Learning

Web-Security-Learning Indirizzo del progetto: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Attacco e difesa delle vulnerabilità: https://t.zsxq.com/mm2zBeq Indice: Web-Security-Learning Web Security SQL injection MySql MSSQL PostgreSQL MongoDB Tecniche Strumenti XSS CSRF Altr...

CVE-2026-82477

MITRE SAF Heimdall versions 2.11.6 through 2.13.x are affected by a Server-Side Request Forgery (SSRF) vulnerability in the Tenable proxy endpoint , specifically in apps/backend/src/tenable/tenable.controller.ts. A remote, unauthenticated attacker can leverage this flaw to access internal network...

CVE-2026-20230

CVE-2026-20230 - Cisco Unified CM ⚡ Utilizzo Semplice Usa questo progetto solo in ambienti sicuri e autorizzati, come: Macchine virtuali locali Container Docker Ambienti di laboratorio isolati Ambienti di test di penetrazione autorizzati Esempio di configurazione: root@kitploit: git clone...

CVE-2021-32159

..| CSRFtoCommandInjection1 |.. Descrição : Explorando um ataque de falsificação de solicitação entre sites CSRF para obter uma Injeção de Comando através da funcionalidade de Upload e Download do Webmin Versão Testada : Webmin 1.973 versão mais recente do GitHub 07/03/2021 Tipo de Ataque: Remoto...

CVE-2026-44578

🚨 CVE-2026-44578 — Vulnerabilità SSRF di Next.js 📌 Panoramica CVE-2026-44578 è una vulnerabilità Server-Side Request Forgery SSRF di alta gravità che colpisce le applicazioni Next.js self-hosted. Gli attaccanti possono sfruttare richieste di upgrade WebSocket appositamente create per forzare il...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 sfruttamento semplice di SSRF esercizio con golang Versioni interessate Exchange Server 2013 precedente a CU23 Exchange Server 2016 precedente a CU18 Exchange Server 2019 precedente a CU7 Condizioni di sfruttamento Questa vulnerabilità è diversa dalle precedenti...

CVE-2021-46080

CVE-2021-46080 Exploit-Titel: Vehicle Service Management System – „Mehrere“ Cross-Site-Request-Forgery CSRF führen zu Stored Cross-Site-Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM Referenzen:...

CVE-2022-42889-Text4Shell-POC

سكربت اختبار CVE-2022-42889 Text4Shell يحتوي هذا المستودع على سكربت Python لأتمتة عملية اختبار ثغرة أمنية تُعرف باسم Text4Shell، والمشار إليها بالمعرف CVE-2022-42889. حول Text4Shell CVE-2022-42889 تُعد Text4Shell ثغرة حرجة تؤثر على مجموعة واسعة من الأنظمة. تكمن الثغرة في الطريقة التي تحلل بها هذه...