poc_proxylogon

pocproxylogon Microsoft Exchange ProxyLogon PoC（CVE-2021-26855） 这个脚本最初由 celesian 编写，用于利用此 CVE。 随后我对其进行了更新，以利用存在 SSRF 漏洞的 Exchange 服务器，结果却通过利用 EWS 功能获取到了一个 Shell，因为一家客户公司通过禁用 /ecp/DDI/DDIService.svc/ 功能修补了其 Exchange 服务器，哈哈。 此脚本可能无法在多种环境中运行，而且该代码仅是一个概念验证，用于确认你的环境是否存在漏洞；未经明确授权，请勿使用它攻击第三方基础设施！...

react2shell

React2Shell Go 版本 React2Shell 是一款用 Go 编写的高性能漏洞扫描器，专门用于检测 Next.js 应用程序中的服务器端远程代码执行（RCE）漏洞（CVE-2025-55182 和 CVE-2025-66478）。 该工具通过利用 Go 的原生并发（Goroutines）并集成 Subfinder 的自动侦察功能，改进了现有的概念验证脚本。 主要特性 自动侦察：使用 -u 指定域名时会自动触发 Subfinder 发现并扫描子域名。 高并发性：采用工作池模式，同时处理数百个目标。 精确的 Payload：实现特定字符编码（\x60），确保 Next.js...

POC_CVE-2025-14700

CVE-2025-14700 用于 CVE-2025-14700 的概念验证（PoC）利用程序，该漏洞是 Crafty Controller = 4.6.1 中的一个服务端模板注入（SSTI）漏洞。允许经过身份验证的用户通过向 Webhook 配置中注入恶意 Jinja2 模板来实现远程代码执行（RCE）。 📦 安装 克隆仓库 git clone https://github.com/secdongle/POCCVE-2025-14700 cd POCCVE-2025-14700 🛠️ 测试环境（Docker Compose） 要搭建一个存在漏洞的 Crafty Controller...

CVE-2024-32651-changedetection-RCE

CVE-2024-32651 changedetection --port --ip --notification 6. 致谢 此修复版本的利用脚本基于 Zach Crosman zcrosman 发布的原始利用脚本（EDB-ID: 52027）。 您可以在此处查看原始利用脚本。 我感谢 Zach Crosman 对安全社区的贡献。...

CVE-2026-103291

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

CVE-2026-103082

Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

EUVD-2026-90684

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

EUVD-2026-90747

Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

cve-2025-55182

CVE-2025-55182 Python 漏洞利用 Python 3 脚本，可用于演示 CVE-2025-55182 。它利用了 Next.js/React 应用程序中的服务器端 JavaScript 注入漏洞，通过格式错误的多部分表单数据实现远程代码执行 。 ⚠️ 仅用于教育和授权测试目的。 实验环境设置 参考 https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/ npx...

CVE-2025-68705

CVE-2025-68705 - RustFS 路径遍历漏洞利用工具 描述 该脚本利用了 RustFS 中的一个路径遍历漏洞（CVE-2025-68705），可允许读取服务器上的任意文件。 环境要求 Python 3.6+ 依赖项见 requirements.txt 安装 git clone https://github.com/yourusername/CVE-2025-68705.git cd CVE-2025-68705 pip install -r requirements.txt 使用方法 python exp.py -H -p -f -s 必需参数 参数| 说明 ---|--...

CVE-2026-103542

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

EUVD-2026-90502

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542

A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...

Chromium CVE-2026-87595: Server-side request forgery in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2024-6386-WPML-SSTI

This repository does not have a README...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23919)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523919 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride FileInfo...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl (CENTOS6:CLSA-2026:1781253209)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781253209 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1767970357)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1767970357 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...