PoC-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server 경로 탐색 익스플로잇 CVE-2021-41773의 Python 익스플로잇으로, Apache HTTP Server 2.4.49에서 서버의 임의 파일을 읽을 수 있게 하는 경로 탐색 취약점입니다. 취약점 세부 정보 CVE-2021-41773 은 Apache HTTP Server 2.4.49에서 사용자 제공 경로에 대한 부적절한 검증으로 인해 발생하는 경로 탐색 취약점입니다. 이 취약점을 통해 공격자는 URL 인코딩된 경로 탐색 시퀀스를 사용하여 문서 루트 외부의 파일을 ...

CVE-2024-46635

CVE-2024-46635 背景 GongZhiDao システムは、GongZhiDao によって開発されたプラットフォームです。ユーザー管理、データ分析、運用機能などのエンタープライズ向けソリューションを提供します。しかし、適切な認可なしに機密ユーザー情報が露呈する可能性があるセキュリティ脆弱性が、あるAPIエンドポイントで発見されました。 脆弱性の説明 GongZhiDao システムの /oaa/api/AccountMaster/GetCurrentUserInfo API エンドポイントに脆弱性が存在します。UserNameOrPhoneNumber パラメータの代わりに...

CVE-2023-42793

CVE-2023-42793について まず別のエクスプロイトを使用してトークンを取得する必要があります。ただし、以下のエクスプロイトはペイロードをURLにエンコードしてサーバーに送信するため、Linuxサーバー上でRCEを取得できます。 使用方法 root@kitploit: python3 ./main -t TEAMCITYTOKEN -u http://teamcity.runner.htb -p 80 -ni LISTENERIP -np LISTENERPORT...

CVE-2021-41773

CVE-2021-41773 — PoC: modcgi 経由の Path Traversal + RCE 管理された自分専用の環境でのみ使用すること。許可なくシステムに対して使用しないこと。 説明 Apache HTTP Server 2.4.49 に存在する脆弱性 CVE-2021-41773 を実証・理解するために開発された PoC です。 この欠陥は apnormalizepath 関数にあり、URL エンコードされた文字を適切に検証していませんでした。これにより、攻撃者はエンコードされた文字列（../ の代わりに %2e%2e%2f）を使うことで DocumentRoot...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-12071 TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

EUVD-2026-45379

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

PT-2026-60961

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...

GHSA-62GX-5Q78-WRVX obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

Summary The Local REST API's /vault/path endpoints GET/PUT/PATCH/POST/DELETE percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal ../ is resolved/rejected at the...

CVE-2026-42447 jadx: HTML Injection in Summary panel

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...

CVE-2026-53539

A flaw was found in Python-Multipart, a streaming multipart parser. A remote attacker can exploit this vulnerability by submitting a specially crafted application/x-www-form-urlencoded body. This can cause the QuerystringParser to perform inefficient processing, leading to excessive CPU...

CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

PT-2026-57296

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description On Windows, the RabbitMQ management plugin static file handler rabbit mgmt wm static can pass URL-encoded backslashes to the erl prim loader:read file info function...

GO-2026-5108 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall...

CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decodeeach/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...

CVE-2026-53538

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only...

SUSE-SU-2026:2487-1 Security update for rmt-server

This update for rmt-server fixes the following issues - CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content bsc1261398. - CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting bsc1261471. -...

CVE-2026-8100

Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass...