CVE-2026-13046

A deserialization of untrusted data vulnerability exists in the SAML single sign-on session handling (samld) component of WatchGuard Fireware OS . An attacker who has already successfully obtained the ability to write files on the appliance can execute arbitrary code in the context of the samld s...

CVE-2026-13046 Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...

CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

CVE-2025-57520 – Stored XSS in Decap CMS Steps 1. Login as Contributor/Editor low privilege. 2. Create a new blog entry. 3. Insert the payload into one of the vulnerable fields e.g., title. 4. Save the entry. 5. Login as Admin high privilege. 6. Open the entry in Preview. 7. Payload executes in t...

CVE-2025-5777-CitrixBleed

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – exploit de prueba de concepto para NetScaler ADC/Gateway “fuga de memoria” CVE-2025-5777 es una lectura crítica fuera de los límites no autenticada en Citrix NetScaler ADC/Gateway modo Gateway o AAA vServer. Una única solicitud manipulada...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

CVE-2023-27524

CVE-2023-27524: Bypass de autenticación en Apache Superset Script para comprobar si un servidor Apache Superset se está ejecutando con una configuración predeterminada insegura CVE-2023-27524. El script comprueba si las cookies de sesión de un servidor Superset están firmadas con alguna de las...

CVE-2026-71302

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...

CVE-2026-71189

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-71302

The Toptech TMS7 and TopHAT applications are vulnerable to a session fixation flaw. The software accepts user-supplied session identifiers and fails to regenerate the session ID upon successful authentication. This allows an attacker to predefine a session ID and reuse it after a victim authentic...

CVE-2026-71302 Toptech TMS7 and TopHAT Session Fixation

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...

CVE-2024-50962

Cross-Site Scripting XSS en DonWeb Ferozo Webmail CVE-2024-50962 Descripción Una vulnerabilidad de Cross-Site Scripting XSS en Ferozo Webmail v1.1 permite a atacantes ejecutar scripts arbitrarios a través de los componentes Identities y Automatic Responses. Esta vulnerabilidad puede ser utilizada...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 Existe una vulnerabilidad de cross-site scripting XSS reflejado en múltiples URL de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión de los usuarios y suplantar su cuenta a través de una URL manipulada. Nota: XSS también funciona cuando estas...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

EUVD-2026-89411

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Fijación de Sesión en Vvveb CMS v1.0.6.1 Autor: Andrew Paul Fecha de Descubrimiento: 9 de junio de 2025 Vendedor: Vvveb URL del Vendedor: http://vvveb.com GitHub del Vendedor: https://github.com/givanz/Vvveb Versión Afectada: 1.0.6.1 y probablemente versiones anteriores ID CVE: CVE-2025-8517...

CVE-2025-55579

CVE-2025-55579 - Cross-Site Scripting XSS Almacenado en SolidInvoice en Tasas de Impuestos Resumen SolidInvoice es vulnerable a un problema de Cross-Site Scripting XSS Almacenado en la función de Tasas de Impuestos. Un atacante autenticado puede inyectar JavaScript arbitrario en la aplicación, qu...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

EUVD-2026-89180

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-102716

An unauthenticated client can cause a Denial of Service (DoS) on an RTSP server by draining its packet pool. The vulnerability exists in the Session branch of the parser within nx_rtsp_server.c, where a failure in _nx_utility_string_to_uint returns a raw NetX error code instead of a proper RTSP s...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...