60045 matches found
CVE-2025-29602
CVE-2025-29602 - Vulnerabilidades de cross site scripting XSS almacenado en FlatPress CMS 1.3.1 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el panel de administración de Flatpress CMS 1.3.1. Un atacante con privilegios de administrador puede inyectar una carga...
CVE-2020-9484
La herramienta se utiliza únicamente para investigación de seguridad y auditorías internas. Está prohibido usar la herramienta para lanzar ataques ilegales; el usuario es responsable de las consecuencias. La herramienta se utiliza únicamente para investigación de seguridad y auditorías internas...
CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit
Wing FTP Server v8.1.2 contains a Remote Code Execution RCE vulnerability in the session serialization mechanism. An authenticated administrator can inject arbitrary Lua code through the domain admin mydirectory basefolder field, which gets executed server-side via loadfile. This is a separate...
Termix-research
Investigación de seguridad de Termix Investigación de vulnerabilidades en Termix, una plataforma web de gestión de SSH y servidores más de 13k estrellas. CVE| Problema| Severidad| Corregido| Aviso ---|---|---|---|--- CVE-2026-45746| Secuestro de sesión → RCE| 9.0 Crítica| v2.3.2|...
trawl
TRAWL Bienvenido a TRAWL! 👋 Web scraping autoalojado para aplicaciones y agentes de IA. Obtén páginas a través de la API nativa, o conecta un cliente MCP para leer Markdown limpio, extraer datos estructurados, capturar pantallas e inspeccionar la actividad del navegador. TRAWL comienza con una...
PoC-RCE-Rukovoditel
PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...
CVE-2026-67279
Colección de PoC de MikroTik RouterOS Este repositorio contiene scripts de prueba de concepto PoC para varios problemas de seguridad de MikroTik RouterOS investigados y documentados en 2026. Los materiales están destinados únicamente a investigación de seguridad autorizada, validación en...
CVE-2026-61500
CVE-2026-61500: Falsificación de sesión en Rejetto HFS hasta RCE CVE-2026-61500 es una vulnerabilidad de falsificación de sesión no autenticada en Rejetto HFS 3.0.0 hasta 3.2.0. HFS generaba su clave de firma de cookies de sesión de Koa con JavaScript Math.random y exponía salidas del mismo PRNG ...
CVE-2026-20079-checker
CVE-2026-20079 Cisco FMC Read-Only Checker Una pequeña utilidad de validación deliberadamente limitada para CVE-2026-20079 , la vulnerabilidad de omisión de autenticación de Cisco Secure Firewall Management Center FMC. Este repositorio es un verificador, no un exploit. No contiene las partes de...
CVE-2025-14855-POC
CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
Apache-Tomcat-CVE-2025-24813-Lab
CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...
CVE-2025-55887
CVE-2025-55887 Description Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject...
CVE-2026-101891: Improper Access Control
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...
CVE-2026-82933: Undefined Security Weakness
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...
CVE-2026-52749: Improper Authentication
The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...
CVE-2026-88805: Insufficient Session Expiration
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...
RHEL 9 : git-lfs (RHSA-2026:72276)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:72276 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...
magento2-session-reaper-patch
Parche de Session Reaper para Magento 2 para CVE-2025-54236 Parche para CVE-2025-54236 también conocido como Session Reaper que permite la apropiación de cuentas de clientes y RCE bajo ciertas condiciones. Este parche es en realidad una extensión de Magento 2 y es universalmente compatible con...