22441 matches found
SSRFmap
SSRFmap SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to...
ssrf-sheriff
SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...
xxexploiter
XXExploiter It generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration. Installation install node and npm if you don't have it yet npm install -g xxexploiter Building & Running from source This is a simple Node application written with...
EUVD-2026-97144
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collectcorpus. Performing a manipulation of the argument sitemapurl results in server-side request forgery. Remote exploitation of t...
EUVD-2026-97143
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function runseoaudit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been...
The vulnerability of the Test IT testing system, related to insufficient validation of requests on the server side, allows a hacker to perform an SSRF attack.
The vulnerability of the Test IT testing management system is related to insufficient testing of server-side requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
The vulnerability of the CrocoTime employee working time management system, related to insufficient validation of requests on the server side, allows a hacker to execute an SSRF attack.
The vulnerability in CrocoTime’s employee working hours tracking system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...
My-CVEs
Una lista de vulnerabilidades que encontré. Algunas vulnerabilidades incluyen análisis técnicos detallados, exploits o incluso tutoriales de sesiones de fuzzing. Algunas vulnerabilidades no tienen CVE porque los mantenedores me ignoraron, o porque un mantenedor no estuvo de acuerdo en que fuera u...
cve-2026-46391
CVE-2026-46391 - Exposición de credenciales mediante SSRF en @haxtheweb/open-apis Prueba de concepto para CVE-2026-46391. Desencadena la vulnerabilidad SSRF en el endpoint cacheAddress de @haxtheweb/open-apis y captura las credenciales de la cuenta de servicio enviadas en el callback. Compilar go...
uro
uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...
EUVD-2026-97127
A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...
xray
Welcome to xray 👋 A Powerful Security Assessment Tool 🏠 Documentation • ⬇️ Download xray • ⬇️ Download xpoc • ⬇️ Download xapp • 📖 Plugin Repository 中文版 Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray...
CVE-2022-46364-Poc
Exploit CVE-2022-46364 Apache CXF SSRF mediante MTOM XOP:Include | CVSS 9.8 CRÍTICO Vulnerabilidad Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerable requerido -s, --ssrf-url - URL interna para exfiltrar requerido -d, --domain - Dominio objetivo por defecto: localhost --plain-soap -...
CVE-2021-42560
CVE-2021-42560: Análisis XML Inseguro en MITRE Caldera El plugin Debrief en Caldera versiones =2.9.0 recibe parámetros "SVG" codificados en base64 al generar un PDF. Estos SVG se analizan de manera insegura y pueden ser aprovechados para ataques XXE por ejemplo, Exfiltración de Archivos,...
CVE-2023-25203
CVE-2023-25203: Aplicación vulnerable a ataques SSRF Server-Side Request Forgery Descripción CVE-2023-25203 identifica una vulnerabilidad en la solución Therefore, que es susceptible a ataques de Server-Side Request Forgery SSRF debido a su uso del software Aspose para convertir archivos subidos ...
Next.js_exploit_CVE-2024-34351
csr-rsc-ssg-isr-ssr-ssrf Este repositorio puede servir como soporte para presentar uno o varios meetups. El recorrido es el siguiente... "CSR" Client Side Rendering: React como librería SPA estándar "RSC" React Server Components: ejecución de componentes React únicamente del lado del servidor "SS...
FC3er
FC3er | CVE-2022-0591 - Formcraft3 Herramienta automática masiva para comprobar vulnerabilidad en CVE-2022-0591 - Formcraft3 install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh Cómo Usar bash fc3er.sh yourlist.txt thread Referencia...
node-ip-vex
node-ip-vex Este proyecto de ejemplo depende del paquete npm node-ip, que es vulnerable a CVE-2024-29415. Sin embargo, como nuestro proyecto no utiliza directamente la función vulnerable .isPublic, no es explotable por CVE-2024-29415. Ejecutar un análisis con Docker Scout Puedo empaquetar mi...
CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer
CVE-2023-27163 - Prueba de concepto de SSRF en Request-Baskets Este es un exploit de prueba de concepto PoC y un bruteforcer de puertos de localhost para CVE-2023-27163 , una vulnerabilidad de falsificación de solicitudes del lado del servidor SSRF en Request-Baskets. El PoC abusa del parámetro...