59962 matches found
CVE-2025-24813
CVE-2025-24813 Exploit Toolkit Esta es una herramienta de explotación avanzada y automatizada para CVE-2025-24813 , dirigida a servidores Apache Tomcat vulnerables a la deserialización insegura de sesiones. 🔍 Características Escaneo de múltiples objetivos desde archivo o una sola URL --targets /...
CVE-2025-5777
CVE-2025-5777 — Divulgación de memoria "CitrixBleed 2" en Citrix NetScaler Informe de investigación de Sentinel AI Defense. Solo análisis defensivo — aquí no se publica ningún exploit funcional ni PoC. La secuela del CitrixBleed original: una lectura fuera de los límites en los endpoints de...
CVE-2023-45542
CVE-2023-45542 Existe una vulnerabilidad de cross-site scripting XSS reflejado en el parámetro q de la función de búsqueda de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión de los usuarios y suplantar su cuenta mediante una URL manipulada. Parámetro vulnerable: q Exploit...
CVE-2025-51860
CVE-2025-51860 Descripción de la vulnerabilidad TelegAI, una aplicación web para construir y chatear con personajes de IA, es vulnerable a Cross-Site Scripting Almacenado XSS en su componente de chat y en el componente contenedor de personajes. Un atacante puede lograr la ejecución arbitraria de...
CVE-2026-101269
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...
CVE-2024-34452
CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...
CVE-2021-24807
CVE-2021-24807 Support Board 3.3.4 XSS Almacenado Autenticado Existe una vulnerabilidad de Cross Site Scripting XSS Almacenado Autenticado en Support Board Versión 3.3.4 a través del parámetro Notes. El impacto de las vulnerabilidades de cross-site scripting puede variar de una aplicación web a...
CVE-2026-101269
A flaw in the mechanism binding API-uploaded files to specific authentication methods allows the same session token to be used for all token-based API users. Although the protection mechanism is rendered useless , the documents state there is virtually no risk because the uploaded files are refer...
CVE-2026-101269 Incorrect session validation for API-uploaded files
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...
CVE-2026-101269 Incorrect session validation for API-uploaded files
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...
CVE-2026-101268 Customer session fixation
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...
CVE-2026-101268
CVE-2026-101268 describes a customer session fixation vulnerability. An attacker can use a specially crafted link to trick a victim into logging into the attacker's customer account. If successful, the victim's order details may be stored within the attacker's account. This attack is specifically...
CVE-2026-101268 Customer session fixation
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...
CVE-2023-44813
CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...
CVE-2023-43325
mooSocial: XSS CVE-2023-43325 Existe una vulnerabilidad de cross-site scripting XSS reflejado en el parámetro dataredirecturl en la función de inicio de sesión de mooSocial v3.1.8, lo que permite a los atacantes robar las cookies de sesión del usuario y suplantar su cuenta mediante una URL...
CVE-2025-47812
CVE-2025-47812 — Wing FTP Server RCE sin autenticación reescritura Exploit en Python para la RCE por inyección Lua no autenticada en Wing FTP Server ≤ 7.4.3. Diseñado para entrega de shell — un comando desde check hasta un callback netcat funcional. Escrito hace tiempo para el laboratorio wingDat...
CVE-2022-29359
Sistema de Aplicación para Clubes Escolares Problema: Cross-Site Scripting Almacenado No Autenticado hasta inyección HTML y RCE Autor: Zak Clifford Fecha: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...
CVE-2024-55040-Sensaphone-XSS
SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-September 2024, I identified several medium-to-low severity security issues in the Sensaphone Web600 Monitoring System, including stored cross-site scripting XSS vulnerabilities in the system Setup, Profile, and Zone options. Remote authenticated...