Lucene search
+L

620 matches found

Kitploit
Kitploit
added 2026/09/19 4:17 a.m.9 views

PoC-CVE-2025-12097

CVE-2025-12097 Description NI modification of Appweb server contains a directory traversal vulnerability that allows an attacker to read arbitrary files on the server. URI path /.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/windows/win.ini will be converted to: pathInfo cchar...

8.7CVSS6.2AI score0.00617EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/18 11:37 p.m.8 views

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

7.2CVSS5.9AI score0.0019EPSS
SaveExploits1
NVD
NVD
added 2026/09/18 3:17 p.m.6 views

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

4.2CVSS0.00131EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/18 2:29 p.m.16 views

CVE-2026-85511

A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...

4.2CVSS0.00131EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/18 2:29 p.m.39 views

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

4.2CVSS0.00131EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/18 2:29 p.m.9 views

EUVD-2026-82946

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

4.2CVSS0.00131EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/09/18 2:29 p.m.10 views

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

4.2CVSS0.00131EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/09/18 2:23 p.m.10 views

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

4.2CVSS0.00131EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/09/18 10:11 a.m.9 views

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

9.1CVSS0.0037EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/17 4:53 p.m.9 views

apache-cve-2021-41773-lab

Apache 2.4.49 Path Traversal Lab — CVE-2021-41773 Clone root@kitploit: git clone https://github.com/zubairahm3d/apache-cve-2021-41773-lab.git cd apache-cve-2021-41773-lab chmod +x apachelab.sh Usage Start the vulnerable server: root@kitploit: ./apachelab.sh choose option 1 Manual exploit:...

9.8CVSS8.4AI score0.99992EPSS
SaveExploits165
RedHat Linux
RedHat Linux
added 2026/09/17 4:09 p.m.8 views

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

9.1CVSS0.0037EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/09/17 3:17 p.m.7 views

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

9.1CVSS0.0037EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/09/17 3:07 p.m.7 views

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

9.1CVSS0.0037EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/09/17 3:04 p.m.9 views

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

9.1CVSS0.0037EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/17 1:41 a.m.13 views

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing...

7.5CVSS8.2AI score0.66535EPSS
SaveExploits4
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/16 4:29 p.m.7 views

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.25

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.25 Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This...

9.1CVSS0.00506EPSS
SaveExploits1Affected Software1
Kitploit
Kitploit
added 2026/09/15 11:23 p.m.8 views

CVE-2021-41773

CVE-2021-41773 Usage root@kitploit: docker-compose up -d --build vuln-server-no-cgid python no-cgid/exploit.py root@kitploit: docker-compose up -d --build vuln-server-cgid-sh python cgid-sh/exploit.py What is CVE-2021-41773? CVE-2021-41773 Directory traversal vulnerability in Apache HTTP Server...

9.8CVSS8.4AI score0.99992EPSS
SaveExploits165
Kitploit
Kitploit
added 2026/09/15 11:22 p.m.7 views

CVE-2021-41773

CVE-2021-41773 exploit PoC with Docker setup. CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-41773:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-41773:1.0 Note: You can also use Image ID...

9.8CVSS8AI score0.99992EPSS
SaveExploits165
OSV
OSV
added 2026/09/14 4:34 p.m.12 views

OESA-2026-3785 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

5.6CVSS6AI score0.00292EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/09/14 12:01 p.m.16 views

Astra Linux – Vulnerability in Apache2

A encoding issue in the modproxy component of the Apache HTTP Server 2.4.59 and earlier versions allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication through crafted requests. Users are recommended to upgrade to version 2.4.60, which fix...

8.1CVSS6.7AI score0.25878EPSS
SaveExploits1References2
Rows per page
Query Builder