Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/jet-pentest/cve-2023-45966
ReconnaissanceVulnerability AnalysisInformation GatheringWeb SecurityPenetration Testing
GitHubjet-pentest/cve-2023-45966

CVE-2023-45966

Proof-of-concept for CVE-2023-45966: Blind SSRF in Remark42 comment system via crafted JSON to /api/v1/comment, enabling internal network reconnaissance.

View Repository
22 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-45966

Blind SSRF in umputun/remark42 <= 1.12.1 [Suggested description] An issue was found in umputun/remark42 <= 1.12.1. Malicious JSON in POST request to /api/v1/comment?site=<SITE_ID> leads to Blind SSRF due to missing title field and insufficient filtering of url field in comment creation request.

[Additional Information] Fixed in commit: efceed6

[VulnerabilityType Other] CWE-918: Server Side Request Forgery

[Vendor of Product] https://github.com/umputun

[Affected Product Code Base] Affected version: umputun/remark42 <= 1.12.1

[Affected Component] /api/v1/comment

[Attack Type] Remote

[Impact Code execution] false

[Impact Denial of Service] false

[Impact Escalation of Privileges] false

[Impact Information Disclosure] true

[Attack Vectors] An attacker able to send crafted JSON

[Discoverer] Dmitry Kuramin (Jet Infosystems, jet.su)

[Reference] https://jet.su/vuln

Download Tool