CVE-2024-6386-WPML-SSTI

Este repositorio nao tem um README...

CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2024-6387

cve-2024-6387-poc OpenSSH 服务器 sshd 中的信号处理程序竞态条件...

CVE-2026-44578

🚨 CVE-2026-44578 — Vulnerabilidade SSRF no Next.js 📌 Visão Geral CVE-2026-44578 é uma vulnerabilidade de alta gravidade do tipo Server-Side Request Forgery SSRF que afeta aplicações Next.js auto-hospedadas. Atacantes podem explorar solicitações de upgrade WebSocket maliciosas para forçar o servid...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2026-71172

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

EUVD-2026-66664

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-71172

Dell Cloud Disaster Recovery versions 20.2 and prior are affected by a Server-Side Request Forgery (SSRF) vulnerability. A low-privileged attacker with remote network access can exploit this to issue forged server-side requests, resulting in a low confidentiality impact with no impact on integrit...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

CVE-2026-80350

OneUptime before version 12.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery path. The host-literal screening in Common/Server/Utils/SSRFProtection.ts (function isBlockedHostnameLiteral) rejects private and loopback IPv4 addresses and a limited set of IPv6 f...

CVE-2026-80347

mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...

CVE-2021-21110

CVE-2021-21110 CVE-2021-21110 : Exploit di Esecuzione Remota di Codice tramite Iniezione di Template Lato Server in Tiki Wiki CMS GroupWare...

CVE-2022-22954_VMware_PoC

CVE-2022-22954 PoC - VMware Workspace ONE Access Freemarker Server-Side Template Injection Una vulnerabilità, classificata come molto critica, è stata trovata in VMware Workspace ONE Access e Identity Manager. Il componente interessato è Template Handler. Riferimento: https://vuldb.com/?id.196644...

CVE-2019-8451

CVE-2019-8451 https://jira.atlassian.com/browse/JRASERVER-69793 root@kitploit: http://host:port/plugins/servlet/gadgets/makeRequest?url=http://:@'.formathost, port, target https://host:port/plugins/servlet/gadgets/makeRequest?url=https://:@'.formathost, port, target...

CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — Bypass dell'autenticazione / controllo accessi errato in PerfexCRM Nota:...

CVE-2022-26134

CVE-2022-26134 （CVE-2022-26134）uma vulnerabilidade de injeção OGNL remota e não autenticada que resulta em execução de código no contexto do servidor Confluence Requer: Python2 ou Python3 Uso: root@kitploit: python cve202226134.py -url targeturl -cmd "ls -al" python cve202226134.py -url targeturl...

CVE-2018-14716

CVE-2018-14716 PoC per CVE-2018-14716 Titolo dell'exploit: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Data: 2018-07-20 Link del software: https://github.com/nystudio107/craft-seomatic Autore dell'exploit: Sebastian Kriesten 0xB455 Contatto: https://twitter.com/0xB455 CVE:...

CVE-2026-16986

The Booking Package WordPress plugin (versions before 1.7.25 ) contains an unauthenticated price manipulation vulnerability. The plugin fails to validate the payment amount server-side against the stored service price, instead deriving the expected charge from attacker-supplied request values (se...