CVE-2021-42013-EXPLOIT

🚨 CVE-2021-42013 - Ejecución Remota de Código en Apache 2.4.49 y 2.4.50 🚨 CVE-2021-42013 se basa en la vulnerabilidad previamente identificada, CVE-2021-41773. A pesar de los esfuerzos del equipo de Apache por abordar CVE-2021-41773 en la versión 2.4.50, investigaciones posteriores revelaron que ...

CVE-2020-8193

CVE-2020-8193...

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

CVE-2025-31486-Simulation

Laboratorio de Path Traversal de Vite CVE-2025-31486 Un entorno de laboratorio contenedorizado y práctico para simular y explotar la vulnerabilidad de Path Traversal en el servidor de desarrollo de Vite, identificada como CVE-2025-31486. 📖 Acerca de la vulnerabilidad Este laboratorio demuestra un...

CVE-2006-3392

CVE-2006-3392 关于漏洞 Webmin 和 Usermin 中已被报告存在一个漏洞，恶意人员可利用该漏洞泄露潜在的敏感信息。该漏洞是由于处理 URL 时出现未明确的错误所致。攻击者可通过特制 URL 读取服务器上任意文件的内容，且无需有效登录。该漏洞已在 Webmin（1.290 之前的版本）和 Usermin（1.220 之前的版本）中被报告。 这个小型脚本有助于在企业渗透测试和类似 OSCP 的考试中避免使用 MetaSploit msfconsole。 内置的 Grep 功能将帮助您只获取重要信息。 使用示例： root@kitploit: nano...

shiro-cve-2010-3863

apach shiro路径穿越 CVE-2010-3863 漏洞复现 docker本地搭建环境 打开yakit抓包 payload:/./admin/ 成功...

Docassemble - Local File Inclusion

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...

CVE-2019-19781-Checker

CVE-2019-19781-检查器 检查您的网站是否存在CVE-2019-19781漏洞 访问 https://citrix-checker.com 检查您是否受CVE-2019-19781影响 请使用我们的检查器两次以确保准确 本网站将给出您的服务是否受CVE-2019-19781影响的结果。存在一个响应器策略，可在永久修复之前缓解该问题。 要应用修复，请登录控制台或使用putty访问并登录。默认用户名：nsroot，默认密码：nsroot 成功登录后，您可以运行以下命令： enable ns feature responder add responder action...

backdoor.mirai.helloworld

Dasan GPON Router URL 的 ? image 后面添加字符串时...

CVE-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 Exploit para el endpoint SSL VPN de GlobalProtect /ssl-vpn/getconfig.esp que añade un payload XSS manipulado a la URL. Uso root@kitploit: python3 exploit.py -u https://target.com Parámetros -u, --url: URL base del objetivo no incluyas parámetros de consulta Vista previa del...

PoC-CVE-2025-52913

CVE-2025-52913 - MiCollab 路径规范化漏洞 📌 概述 本仓库包含 CVE-2025-52913 的概念验证 PoC 代码，该漏洞影响 Mitel MiCollab 的路径规范化功能。 此问题允许未经身份验证的攻击者通过利用精心构造的 URL 序列（例如 ..;）绕过预期的路径限制，从而访问内部应用程序端点。 ⚠️ 影响 成功利用可能导致： 访问内部和受限端点 暴露敏感应用程序组件 潜在的信息泄露 🎯 受影响端点 该漏洞可通过以下路径触发： root@kitploit: /npm-pwg/loginForm.jsp/...

CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

EUVD-2026-70413

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-73734 Unauthenticated Open Redirect allows URL Manipulation in HPE Networking Fabric Composer Web Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL...

CVE-2026-73734

An unauthenticated open redirect vulnerability exists in the web-based management interface of HPE Networking Fabric Composer , allowing a remote attacker to redirect users to an arbitrary URL. The vulnerability requires user interaction but no prior authentication, carrying a CVSS 3.1 score of 5...

EUVD-2026-68910

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

CVE-2026-82957

CVE-2026-82957 is a server-side request forgery (SSRF) in hyperledger-firefly up to version 1.4.0. The flaw resides in the ValidateOptions function within internal/events/webhooks/webhooks.go of the Webhook Subscription component. Manipulating the url argument allows a remote, unauthenticated att...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...