gitlab-cve-2021-22214

gitlab-cve-2021-22214 Gitlab SSRF Follow us Vulnmachines YouTube Twitter Facebook LinkedIn...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

CVE-2021-40822

CVE-2021-40822 SSRF GeoServer Article: https://gccybermonks.com/posts/cve-2021-40822/ Lab: Clone this repository: git clone https://github.com/phor3nsic/CVE-2021-40822.git Start Lab: cd CVE-2021-40822 && docker-compose up Check if this target is vulnerable: python3 CVE-2021-40822.py -u...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our te...

EUVD-2026-104637

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

poc_proxylogon

pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-26855 This is script was originaly made by celesian to exploit this CVE. Then i updated it to exploit an exchange server vulnerable to SSRF but it got a Shell exploiting the EWS feature, because a client company patched it's exchange server...

CVE-2026-112358

A Server-Side Request Forgery (SSRF) vulnerability exists in TiBillet Lespass (up to version 10e87909c5d526dffa6d424c104fc12860740537). The flaw is located in the get_img_from_url function within the ApiBillet/serializers.py file of the APIv1 component. By manipulating the img_url or image_url ar...

CVE-2026-112299

A server-side request forgery (SSRF) vulnerability exists in the smrealms smr product within the Album Website component. The flaw is located in the isUrlReachable function of the file src/pages/Account/AlbumEditProcessor.php, where manipulating the Website argument allows for remote exploitation...

CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

CVE-2026-112297

A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager versions up to 1.13.12 . The flaw is located within the LLM Configuration Handler component, specifically in the LLMClient.chat function of the file blueprints/api/llm.py. An attacker can remotely initiate th...

CVE-2026-112254

A server-side request forgery (SSRF) vulnerability exists in agit8or1 clientst0r up to version 3.17.586 . The flaw is located in the _fetch_html function within the Property URL Importer component (file: locations/services/property_url_importer.py). By manipulating the url argument, an attacker c...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2024-5736

CVE-2024-5736 AdmirorFrames Joomla! Extension 5.0 - Server-Side Request Forgery Timeline Vulnerability reported to vendor: 26.01.2024 New fixed 5.0 version released: 06.06.2024 Public disclosure: 28.06.2024 Description Server-Side Request Forgery in AdmirorFrames Joomla! Extension in afGdStream.p...

CVE-2019-12384

CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException...

Havoc-C2-SSRF-poc

CVE-2024-41570: Havoc-C2-SSRF-poc This vulnerability is exploited by spoofing a demon agent registration and checkins to open a TCP socket on the teamserver and read/write data from it. This allows attackers to leak origin IPs of teamservers and much more. Full analysis:...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

EUVD-2026-104400

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...