Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

CVE-2026-21994

CVE-2026-21994 摘要 Oracle OKIT（oci-designer-toolkit）版本 0.3.0 包含两个严重的错误配置，可串联导致未经身份验证的完全接管。公开仓库中暴露的硬编码 Flask SECRETKEY 允许任何攻击者伪造有效的管理员会话 Cookie——无需任何凭据。此外，Docker 镜像完全禁用了 SSH 主机验证，使网络攻击者能够在基础设施部署期间拦截 OCI API 密钥和私钥。 漏洞 1. 硬编码SECRETKEY — okitclassic/okitserver/config.py:4 root@kitploit:...

CVE-2024-3400-poc

CVE-2024-3400 漏洞 PoC（验证工具） 漏洞描述 CVE-2024-3400 是一个存在于 Palo Alto 防火墙系统中的命令注入漏洞。攻击者通过精心构造的 HTTP 请求，能够在目标服务器上执行恶意命令，甚至获取 root 权限。 漏洞复现步骤 1. 发送以下 HTTP 请求： root@kitploit: POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: 127.0.0.1 Cookie:...

CVE-2026-23723-POC

CVE-2026-23723 PoC - WeGIA 认证 SQL 注入漏洞利用辅助工具 WeGIA ≤ 3.6.1 中的认证错误型 SQL 注入 GHSA-xfmp-2hf9-gfjp | 官方公告 PoC 原作者 / 报告者 ：ViniCastro2001 GHSA 发布者 ：nilsonLazarin（项目维护者） 这个轻量级 Python 脚本可自动化执行： 使用提供的凭据登录 WeGIA 系统 提取有效的 PHP 会话 Cookie 生成兼容 sqlmap 的请求文件（注入点标记为 idmemorando=1） 输出可直接运行的 sqlmap 命令，用于枚举、交互式 Shell...

EUVD-2026-81292

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

cve-2020-10977-read-and-execute

CVE-2020-10977 读取与执行 关于 CVE-2020-10977 HackerOne 报告：https://hackerone.com/reports/827052 Exploit-DB：https://www.exploit-db.com/exploits/48431 如何手动复现执行部分：从读取到执行 关于本仓库 getsecret.py — 主脚本。它首次使用 thewhiteh4t 的代码来利用 cve-2020-10977，并从给定仓库中获取 secretkeybase。然后它会启动 cookiemaker.sh 来生成包含 payload 的 cookie。...

CVE-2026-39324

CVE-2026-39324 漏洞利用 PoC Rack::Session::Cookie 解密失败时回退接受未加密 Cookie | ---|--- 安全公告| GHSA-33qg-7wpp-89cq 软件包| rack-session RubyGems 受影响版本| = 2.1.1 已修复版本| 2.1.2 概述 使用 secrets: 配置的 Rack::Session::Cookie 应仅接受加密 Cookie。但当解密失败时，它不会拒绝该 Cookie，而是回退到默认的 Base64::Marshal 编码器。 攻击者可以发送一个纯文本的 Base64Marshal.dump...

CVE-2026-92592

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

PAN-OS CVE-2024-3400 コマンドインジェクション試行の調査 概要 本プロジェクトでは、PAN-OS GlobalProtect サービスを標的とした CVE-2024-3400 のコマンドインジェクション試行 の調査について記録しています。 目的は以下の判断です： 実際の攻撃であるかどうか コマンド実行が発生したかどうか 侵害の痕跡がないかどうか アラート概要 重大なアラートがトリガーされ、悪用試行の可能性が示されました。 ターゲット：172.16.17.139 PA-Firewall-01 送信元：144.172.79.92...

CVE-2026-92592

Craft CMS 4.8.0–4.18.5 and 5.0.0–5.10.12 are affected by a remote code execution vulnerability (CVSS 3.1 score 8.8 High ). The root cause is that the HMAC signature for the license-shun cookie is not bound to its purpose—Yii's cookieValidationKey derives from the same Craft securityKey used for s...

CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92773

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92751

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-6274

CVE-2026-6274：Redline WR3200 身份验证绕过 English | Turkish 本仓库包含 CVE-2026-6274 的技术细节和概念验证（PoC）。该漏洞存在于 Redline WR3200 路由器（固件版本 v7.1.8 之前）中，允许攻击者在不知道当前凭据的情况下绕过身份验证并更改管理员密码。 技术分析 该漏洞源于两个主要安全缺陷： 1. 静态 Cookie 身份验证： 路由器依赖静态 cookie（user=admin&platform=1）来识别管理会话。 2. IP 验证绕过： 虽然大多数端点要求基于 IP...

EUVD-2026-81053

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...