CVE-2021-3831

PHP-эксплойт CVE-2021-3831 Скрипт Обзор Этот PHP-скрипт предназначен для взаимодействия с целевым веб-сайтом путем генерации определенных MD5-хешей и выполнения HTTP-запросов для эксплуатации потенциальных уязвимостей. Он предназначен для образовательных целей и должен использоваться только в...

CVE-2022-24112_POC

POC POCs collectés CVE-2022-24112 Pour l'environnement du laboratoire Chunqiu Yunjing CVE-2022-24112, j'ai modifié deux POCs, en adaptant légèrement ceux de M4xSec et twseptian pour les adapter au laboratoire Chunqiu Yunjing : Chunqiu Yunjing:CVE-2022-24112 : Apache APISIX est un service de...

SpringBreakVulnerableApp

Spring Break 취약 애플리케이션 Spring Break 취약점CVE-2017-8046에 대한 익스플로잇을 테스트하기 위한 취약 애플리케이션입니다. 경고! 이 애플리케이션에는 심각한 보안 취약점이 포함되어 있습니다. 실행 시 본인 책임입니다! 백업된 격리 환경예: 최신 스냅샷과 호스트 전용 네트워킹을 갖춘 VM에서 사용하는 것이 권장됩니다. 이 애플리케이션을 인터넷에 노출된 서버에 업로드하지 마십시오. 반드시 침해될 것입니다. 면책 조항 : 본 애플리케이션SpringBreakVulnerableApp을 사용하는 방식에 대...

CVE-2026-2020-SSRF-via-URL-Parser-Differential

CVE-2026-2020 – SSRF через расхождение URL-парсеров Код программы Python vulnerableservice.py - Validates URL with urllib.parse, fetches with requests from flask import Flask, request import requests import urllib.parse app = Flaskname def isallowedurlurl: parsed = urllib.parse.urlparseurl Only...

Apache-APISIX-CVE-2022-24112

Apache APISIX Remote Code Execution CVE-2022-24112 - Эксплойт Краткое описание Злоумышленник может использовать плагин batch-requests для отправки запросов, обходящих ограничение IP-адресов для Admin API. Конфигурация Apache APISIX по умолчанию с ключом API по умолчанию уязвима для удаленного...

POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 и CVE-2025-48976 О проекте Этот проект запускает простую конечную точку загрузки файлов с Tomcat 10.1.41 и Jakarta Servlet. По умолчанию эксплойт запускает 1000 параллельных multipart-запросов с 1000 частей и 50 заголовками на часть, от 50 рабочих. Запуск POC Соберите и запустите...

stack-overflow-poc

CVE-2018-12086 PoC https://nvd.nist.gov/vuln/detail/CVE-2018-12086 https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2018-12086.pdf TL;DR: certaines piles OPC UA sont vulnérables à un débordement de pile lors du décodage de requêtes spécialement conçues...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

MAL-2026-17570 Malicious code in throttle-requests (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in throttle-requests (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Blackash-CVE-2025-55182

🚨 CVE-2025-55182 — Критическая уязвимость React Server 🧠 Что это такое ⚛️ Критическая уязвимость безопасности в React Server Components RSC 🧨 Вызвана небезопасной десериализацией 🌐 Эксплуатируется через сетевые запросы 🔓 Аутентификация не требуется ☠️ Может привести к удаленному выполнению кода RCE...

CVE-2023-27163-exploit

CVE-2023-27163 — SSRF-эксплойт для request-baskets Я написал этот эксплойт для использования CVE-2023-27163 — уязвимости подделки серверных запросов SSRF, обнаруженной в request-baskets версии ≤ 1.2.1. Ошибка находится в конечной точке /api/baskets/name, где параметр forwardurl позволяет...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...

PT-2026-106211

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Logout functionality clears the browser's auth-token cookie but fails to revoke the corresponding server-side session. This allows a previously captured session token to remain valid and be used to...

CVE-2026-105648: Incomplete List of Disallowed Inputs

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

Cisco ASA Improper Input Validation (CVE-2020-3304)

A vulnerability in the web interface of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is...

CVE-2026-105647: Time-of-check Time-of-use (TOCTOU) Race Condition

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

PT-2026-106181

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

Cisco ASA Missing Release of Resource after Effective Lifetime (CVE-2023-20095)

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to imprope...

Cisco ASA Uncontrolled Resource Consumption (CVE-2019-12698)

A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load f...