12119 matches found
poc_proxylogon
pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-26855 This is script was originaly made by celesian to exploit this CVE. Then i updated it to exploit an exchange server vulnerable to SSRF but it got a Shell exploiting the EWS feature, because a client company patched it's exchange server...
nuclei-templates
Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation β’ Contributions β’ Discussion β’ Community β’ FAQs β’ Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...
Security Bulletin: Vulnerability in InformixHQ
Summary Upgrade to InformixHQ 3.3.3 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normaliz...
CVE-2026-119575
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...
CVE-2019-12384
CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException...
EUVD-2026-113942
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery...
VMWare-vRealize-SSRF
VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 USE python CVE-2021-21975.py...
CVE-2026-64849-poc-lab
Security Lab β SSRF Exploitation in MLflow Webhooks CVE-2026-64849 Β· MLflow Restricted use: lab material, only for authorized networks and environments. See Legal notice. 1. Executive summary Attribute| Value ---|--- Vulnerability| CVE-2026-64849 β SSRF via Webhook Redirect Bypass Affected...
CVE-2026-119428
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...
CVE-2022-41040
CVE-2022-41040 Microsoft Exchange vulnerable to server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...
CVE-2022-46364-htb-ctf
DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...
CVE-2024-27954
β οΈ CVE-2024-27954 π Automatic Remote code Execution Exploit Tools | By GhostSec π π Description Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from...
GitLab-SSRF-CVE-2021-22214
CVE-2021-22214 POC for CVE-2021-22214: Gitlab SSRF Description The remote GitLab install contains a Server-side request forgery SSRF vulnerability as a result of the internal network for webhooks being enabled. A remote, unauthenticated attacker can exploit a registration-limited GitLab instance...
CVE-2026-44578
π¨ CVE-2026-44578 β Next.js SSRF Vulnerability π Overview CVE-2026-44578 is a high-severity Server-Side Request Forgery SSRF vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to...
CVE-2023-27163
PoC of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and sensitive...
CVE-2022-42889-Text4Shell-POC
CVE-2022-42889 Text4Shell Testing Script This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889. About Text4Shell CVE-2022-42889 Text4Shell is a critical vulnerability that affects a wide ran...
verify-ghsa-c4j6-fc7j-m34r
verify-ghsa-c4j6-fc7j-m34r In-band verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 β Server-Side Request Forgery in Next.js via WebSocket upgrade requests. β οΈ For authorized security testing only. You are responsible for ensuring you have permission to test every target you pass to this script...
CVE-2023-27163---SSRF-Baskets-Requests
CVE-2023-27163---SSRF-Baskets-Requests Create by TheAlchimist cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...
NextChat_SSRF_CVE-2023-49785
NextChatSSRFCVE-2023-49785...
CVE-2021-40822
CVE-2021-40822 SSRF GeoServer Article: https://gccybermonks.com/posts/cve-2021-40822/ Lab: Clone this repository: git clone https://github.com/phor3nsic/CVE-2021-40822.git Start Lab: cd CVE-2021-40822 && docker-compose up Check if this target is vulnerable: python3 CVE-2021-40822.py -u...