CVE-2023-27163-POC

CVE-2023-27163 CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/baskets/name. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the...

NodeSecurityShield

Node Security Shield Node Security Shield NSS es una herramienta de protección de aplicaciones en tiempo de ejecución RASP de código abierto que busca cerrar la brecha en la seguridad integral de NodeJS, permitiendo que los desarrolladores e ingenieros de seguridad declaren qué recursos puede...

CVE-2022-22963-Exploit

CVE-2022-22963 Exploit This repository contains a Rust-based exploit for the CVE-2022-22963 vulnerability found in Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions. The vulnerability allows remote code execution and access to local resources through a specially crafted...

Jira-Scan

Jira-Scan ONLY TESTED WITH PYTHON 3 Provide a list of websites to test with out the http or https and this will test each one for the SSRF vun. Use a VPS from DO CVE-2017-9506 The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before...

CVE-2022-22963

CVE-2022-22963 En las versiones 3.1.6, 3.2.2 y versiones anteriores de Spring Cloud Function, al utilizar la funcionalidad de enrutamiento es posible que un usuario proporcione un SpEL especialmente diseñado como una expresión de enrutamiento que puede resultar en la ejecución remota de código y ...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

rakkess

rakkess Revisar Acceso - plugin de kubectl para mostrar una matriz de acceso para recursos del servidor Introducción ¿Alguna vez te has preguntado qué derechos de acceso tienes en un clúster de Kubernetes proporcionado? Para recursos individuales puedes usar kubectl auth can-i list deployments,...

CVE-2019-20372

REFER https://bertjwregeer.keybase.pub/2019-12-10%20-%20errorpage%20request%20smuggling.pdf Chạy Server docker run -it --rm -p 80:80 -v pwd/default.conf:/etc/nginx/conf.d/default.conf nginx:1.17.6 Khai thác printf "GET /a HTTP/1.1\r\nHost: localhost\r\nContent-Length: 56\r\n\r\nGET...

CVE-2017-9506

Prueba de concepto SSRF y XSS root@kitploit: https://jira.you.com//plugins/servlet/oauth/users/icon-uri?consumerUri=http://www.google.co.uk CVE-2017-9506 El IconUriServlet del Atlassian OAuth Plugin desde la versión 1.3.0 anterior a la versión 1.9.12 y desde la versión 2.0.0 anterior a la versión...

CVE-2026-87556

A flaw was found in the Chromium browser. This missing authorization vulnerability allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive system resources...

jira-ssrf

jira-ssrf CVE-2017-9506 El IconUriServlet del Atlassian OAuth Plugin desde la versión 1.3.0 anterior a la versión 1.9.12 y desde la versión 2.0.0 anterior a la versión 2.0.4 permite a atacantes remotos acceder al contenido de recursos internos de la red y/o realizar un ataque XSS a través de Serv...

CVE-2026-81401

Access of resource using incompatible type 'type confusion' in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

cve-2024-38821

cve-2024-38821 Análisis: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

EUVD-2026-72495

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF Vulnerability 📌 Overview CVE-2026-44578 is a high-severity Server-Side Request Forgery SSRF vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to...

CVE-2026-85699

jina-ai reader is affected by a server-side request forgery (SSRF) vulnerability. URL validation is applied only to the initial request but is not re-applied to subsequent redirect hops . An attacker can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, ...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

org.apache.tomcat/tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-84697

Mailpit (open-source mail testing tool) contains a Server-Side Request Forgery (SSRF) vulnerability in its IsInternalIP deny list function (file: internal/tools/net.go). The deny list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix , all...

CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...