HavocPwn

Havoc-PWN Autenticado Esta cadena SSRF-RCE fue inspirada por el POC SSRF de CVE-2024-41570 de chebuya y el Havoc Auth RCE de IncludeSecurity; ambos exploits son increíbles y están muy bien elaborados, ¡por favor den a estos creadores el reconocimiento por su arduo trabajo! chebuya hyperreality...

cve-2026-46391

CVE-2026-46391 - 通过 SSRF 暴露 @haxtheweb/open-apis 中的凭证 CVE-2026-46391 的概念验证。触发 @haxtheweb/open-apis 中 cacheAddress 端点的 SSRF 漏洞，并捕获回调中发送的服务账户凭证。 构建 root@kitploit: go build -o cve-2026-46391 . 测试 root@kitploit: go test ./... 用法 root@kitploit: ./cve-2026-46391 -u -l -p 端口 -t 秒 -v 选项 示例 直接连接（与目标在同一网络）...

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

CVE-2026-88403

nocobase v2.1.21 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its serverRequest function. An authenticated attacker can exploit this via a crafted HTTP request to scan internal resources . No specific remediation or patched version is provided in the available documents, a...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-36469

CuteNews v.2.1.2 is affected by a Server-Side Request Forgery (SSRF) vulnerability in the core/modules/media.php file, specifically within the upload_from_inet function used by the Media Manager's "Upload by URL" feature. An attacker can leverage this to make the server issue requests to arbitrar...

CVE-2021-42560

CVE-2021-42560：MITRE Caldera 中的不安全 XML 解析 Caldera 中的 Debrief 插件（版本 =2.9.0）在生成 PDF 时接收 base64 编码的 "SVG" 参数。这些 SVG 以不安全的方式解析，并可被利用进行 XXE 攻击（例如文件泄露、服务器端请求伪造、带外泄露等）。 供应商披露： 该漏洞的供应商披露信息可在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详细信息和利用过程可在此 PDF 中找到。...

CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer

CVE-2023-27163 - Prueba de concepto de SSRF en Request-Baskets Este es un exploit de prueba de concepto PoC y un bruteforcer de puertos de localhost para CVE-2023-27163 , una vulnerabilidad de falsificación de solicitudes del lado del servidor SSRF en Request-Baskets. El PoC abusa del parámetro...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI 作者： 0xmid00 漏洞： MTOM 请求中通过 XOP:Include 实现 SSRF / 本地文件读取 影响： Apache CXF false test IT john 该利用工具会自动将其转换为 MTOM 格式——您无需手动操作。 示例 模式 1 — 自动检测所有可注入字段 root@kitploit: python3 exp...

exploit-cve

CVE-2024-39713: Rocket.Chat SSRF PoC 描述 服务器端请求伪造（SSRF）影响 Rocket.Chat 6.10.1 之前版本的 Twilio webhook 端点。 链接： https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 使用方法 root@kitploit: pip install -r requirements.txt python3 CVE-2024-39713.py -u Rocket.Chat URL -t SSRF...

CVE-2026-94051

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

htb-sau-exploit-chain

HTB Sau 漏洞利用链 — CVE-2023-27163 SSRF + Maltrail RCE 自动化 一个 Python 漏洞利用脚本，将 CVE-2023-27163（Request Baskets ≤ 1.2.1 中的服务端请求伪造）与 Maltrail 0.53 中的未经身份验证的远程代码执行漏洞串联起来，传递反向 shell。专为 Hack The Box 的 Sau 计算机设计。 📌 概述 该脚本自动化了在目标上获取初始访问权限所需的利用路径，步骤如下： 1. 利用 CVE-2023-27163 获得一个可用的 bucket 端点 2. 借助暴露的服务与 Maltrai...

CVE-2023-27163-lab

CVE-2023-27163 — Laboratorio de SSRF en Request-Baskets Proyecto: Laboratorio de Investigación y Reproducción de Vulnerabilidades — CVE-2023-27163 Autor: Amulya Kaushik Rol: Candidato a Prácticas en I+D de Ciberseguridad y Desarrollo de Contenido para Laboratorios Server-Side Request Forgery en...

CVE-2024-27954

CVE-2024-27954 📝 CVE-2024-27954 - Vulnerabilidad de Path Traversal y SSRF en el plugin WP Automatic Descripción Existe una vulnerabilidad de Limitación Incorrecta de un Nombre de Ruta a un Directorio Restringido 'Path Traversal' en el plugin WP Automatic, que permite ataques de Path Traversal y...

CVE-2023-27163-AND-Mailtrail-v0.53

Exploit Automático Resumen El siguiente exploit abusa de la vulnerabilidad SSRF de Requests Baskets v1.2.1 para redirigir la aplicación interna que se ejecuta en 127.0.0.1:80 hacia la aplicación externa en /pwned. Una vez que la aplicación Mailtrail v0.53 haya sido redirigida, ejecutará un comand...

EUVD-2026-83788

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94051 0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94051

CVE-2026-94051 affects the cowork_bench project (GitHub user 0717376), specifically the ControlFlowNode function in local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py (component pdf-tools-mcp ). The root cause is an unsanitized pdf_file_path argument that enables server-side request forgery (SSR...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF mediante carga de imágenes SVG Resumen Vulnerabilidad de falsificación de solicitudes del servidor SSRF en ThingsBoard IoT Platform en versiones anteriores a 4.2.1. Un atacante con acceso de Tenant Admin puede subir un archivo SVG manipulado que contiene una...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Create by TheAlchimist root@kitploit: cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...