XSRFProbe

XSRFProbe El Kit Definitivo de Auditoría y Explotación de Falsificación de Petición en Sitios Cruzados. -blue.svg Acerca de XSRFProbe es un kit avanzado de auditoría y explotación de Falsificación de Petición en Sitios Cruzados CSRF/XSRF. Equipado con un potente motor de rastreo y numerosas...

CVE-2023-45857-Demo

Demo to verify the behavior of axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev on the app container 3. Access http://app.localhost 4. Verify that XSRF-TOKEN is set in the Cookie using the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false...

CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

exploit_laravel_cve-2018-15133

Exploit Laravel pour CVE-2018-15133 Ce code exploite CVE-2018-15133 et est basé sur le PoC de kosmiz et l'exploit Metasploit pour cette vulnérabilité. Je l'ai surtout réalisé pour une machine sur Hack The Box, parce que je ne voulais pas utiliser Metasploit à ce moment-là et comme excuse pour...

vertx-web-xsrf

Resumen La implementación CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl en Vert.x Web no crea tokens CSRF únicos por sesión de usuario. Un sitio web malicioso aún puede realizar CSRF obteniendo un token CSRF válido y agregándolo a un formulario HTML, y luego enviando el formulario...

Lab-for-cve-2018-15133

Summary: MExploiting CVE-2018-15133 Deserialization Vulnerability This exploit takes advantage of a deserialization vulnerability in the Laravel Framework through 5.5.40 and 5.6.x through 5.6.29. Description Remote code execution might occur as a result of an unserialize call on a potentially...

Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Axios and Netty. Vulnerabilities include Allowing attackers to reach sensitive loopback or internal services despite the configured protections, Prototype pollution in a third-party dependency may be leveraged...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

Larascript

| | | | | | / || '| / |/ | /|| ' || || ' \ | | | | | || | | | | | | | | || | || | || , ||| ,|| / ||| ||| ./ | || Autores: @pwnedshell & @rsgbengi 📌 ¿Qué es Larascript? Larascript es un script que aprovecha el CVE-2018-15133 y puede ejecutar comandos remotos si una aplicación Laravel vulnerable es...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

CVE-2026-54694: Improper Input Validation

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026)

Summary Axios is vulnerable to Prototype Pollution / Transport Hijacking ,HTTP Request/Response Splitting via Gadget ,NOPROXY Protection Bypass ,Denial of Service DoS via Uncontrolled Recursion ,SSRF via Incomplete Proxy Bypass ,JSON API Response Manipulation via Prototype Pollution,XSRF Token...

Exploit for CVE-2026-67919

halo plugin rce from a url halo's console lets admins install...

DoS (Denial of Service) axios Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 a...

Important: python3.13-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

AZL-92382 CVE-2026-49854 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...