ProxyShell

ProxyShell CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability. This faulty URL normalization lets us access an arbitrary backend URL while running as the Exchange Server machine account. Although this bug is not as powerful as the SSRF in ProxyLogon, and w...

CVE-2023-49438

CVE-2023-49438 Proof of Concept Description An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectloc...

React2Shell-CVE-2025-55182

$$\ $$\ $$$$$$$\ $$\ $$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$$$$\ $$$\ $$$ |$$ $$\ $$$\ $$$ |$$ |$$ | $\ $$ |$$ $$\ $$ | $$$$\ $$$$ |$$ | $$ | $$$$\ $$$$ | $$ | $$ |$$$\ $$ |$$ / $$ | $$ | $$$$$$ $$ |$$$$$$$ | $$$$$$ $$ | $$ | $$ $$ $$$$ |$$ | $$ | $$ | $$ $$$ $$ |$$ $$ $$ $$$ $$ | $$ | $$$$ $$$$...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Lab Docker PoC Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

livewire-vuln-scanner

Livewire Passive Vulnerability Scanner Livewire Passive Vulnerability Scanner is a Python 2.7 tool designed to passively detect Livewire versions used by websites and identify potential vulnerabilities based on version comparison. This scanner does not exploit any vulnerability. It only analyzes...

CVE-2021-42013

CVE-2021-41773 / CVE-2021-42013 Apache Vulnerability Scanner A comprehensive Python-based vulnerability scanner for detecting CVE-2021-41773 and CVE-2021-42013 path traversal and remote code execution vulnerabilities in Apache HTTP Server versions 2.4.49 and 2.4.50. Overview CVE-2021-41773 and...

CVE-2019-17662

CVE-2019-17662 Modified the CVE code Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as: For code: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode Results in: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability A Docker-based reproduction environment to reproduce the path traversal vulnerability CVE-2025-55752 in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in the RewriteValve component of Apache Tomcat, cause...

CVE-2026-111754

A flaw was found in @angular/platform-server. This vulnerability allows an unauthenticated remote attacker to trigger an open redirect, sending users to an attacker-controlled external domain. When server-side rendering SSR is enabled, validation checks for protocol-relative links occur before...

CVE-2026-111753

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way...

CVE-2026-111754

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

CVE-2026-119334 Pi-hole: file:// adlist read check and curl can resolve different files

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-119334 Pi-hole: file:// adlist read check and curl can resolve different files

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-119334 Pi-hole: file:// adlist read check and curl can resolve different files

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-119334

Versions of Pi-hole prior to 6.5 are vulnerable to a flaw in gravity.sh where file:// adlist readability is verified using sudo -u pihole test -r, but subsequently processed by curl . This allows an attacker to use a pihole-readable decoy to pass the initial check while curl (potentially running ...

BIT-DISCOURSE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

PT-2026-105080

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed iframes subpath check while browse...

AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine (ALMALINUX9.2:CLSA-2026:1768989206)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768989206 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...

BIT-ENVOY-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

PT-2026-102729

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...