CVE-2025-4162030

Security Advisory: CVE-2025-4162030 This security summary was provided by CoPilot ^1^. The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be...

CVE-2025-4162029

Security Advisory: CVE-2025-4162029 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

CVE-2025-4162026

Security Advisory: CVE-2025-4162026 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

CVE-2025-48461

CVE-2025-48461 Predictable session cookies that can be bruteforced to gain unauthorized access to Advantech WISE portal Summary During examination of Advantech WISE-4060 web portal, I have discovered that the session cookies used to authenticate to the web portal follows the pattern 60D01EXXXXX...

EtwSessionHijacking

EtwSessionHijacking: A Poc on blocking Procmon from monitoring network events Demo: https://user-images.githubusercontent.com/111295429/186082150-32ed304b-ba45-42a4-8baa-37dd75246c68.mp4 Based On : Design Issues Of Modern EDRs: Bypassing ETW-Based Solutions...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

Dumb0

Dumb0 A simple tool to dump users forums popular forums and CMS WordPress, SMF, vBulletin, IP Board, XEN forums, myBB, useBB, vanilla, bbPress.... Supported 27 forums/CMS help us to grow the number!: SMF -- Simple Machine Forums IPB -- Invision Power Board XEN -- Xen Foro VB -- vBulletin myBB --...

CVE-2016-6271

CVE-2016-6271 CVE-2016-6271 impacts libbzrtp, which is a ZRTP library developped by Belledonne Communications. This library is embedded in end-user applications, for example linphone, which is available as an Android app on Play store. Current version 3.2.7 embeds a version of libbzrtp shall not ...

CVE-2022-23131

CVE-2022-23131 CVE-2022-23131Unsafe Session Storage 0x00 Preface Zabbix vulnerability CVE-2022-23131, I accidentally obtained a Zabbix server of a foreign company. Zabbix Sia Zabbix is an open-source monitoring system developed by Zabbix SIA Zabbix Sia from Latvia. This system supports network...

cve-2022-23131

cve-2022-23131 Usage: python3 zabbix.py target Admin target is the target address Admin is fixed as the administrator username Replace the generated zbxsignedsession with the cookie of the current target Click "Sign in with Single Sign-On SAML" on the login page to directly enter the management...

CVE-2025-63441

CVE-2025-63441 Title: Reflected XSS via arbitrarily supplied URL parameter param at endpoint u/administrator/friends Summary: A Reflected Cross-Site Scripting XSS vulnerability was identified in the u/administrator/friends endpoint of the OSSN application. This vulnerability allows attackers to...

React-Router-CVE-2025-61686-

CVE-2025-61686 Vulnerability Analysis Report Vulnerability Overview CVE ID : CVE-2025-61686 Affected Versions : @react-router/node 7.0.0 to 7.9.3 Vulnerability Type : Path Traversal / Directory Traversal Vulnerability Principle 1. Vulnerability Location The vulnerability exists in the getFile...

Kotaemon-CVE-2025-56526-56527-disclosure

Kotaemon CVE-2025-56526 & CVE-2025-56527 Public Disclosure Stored Cross-Site Scripting in the Kotaemon Information Panel combines with plaintext credential storage in localStorage, enabling full session compromise from a single malicious PDF upload. Executive Summary Affected Product / Versions :...

Poc_for_CVE-2025-24813

!/usr/bin/env python3 """ .----------------. .----------------. .----------------. | | | | | | | | \ | | | | .' | | | | | | | | | | / .' | | | | '. | | | | | | | | | | | | | | | \ . | | | |/ | | || | | ..' | '----------------' '----------------' '----------------' """ CVE-2025-24813 Vulnerability...

zabbix-cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbie、@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 Assigned: 11-12-2025 Problem Type: CWE-79 Cross-Site Scripting Affected Product: “AI Font Matcher” posted 2025-10-10, nid=18425 Product page: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html...

CVE-2025-67730

CVE-2025-67730 – Stored Cross-Site Scripting XSS Overview CVE ID: CVE-2025-67730 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: Medium–High context-dependent This vulnerability allowed authenticated users to inject malicious HTML and JavaScript into description fields of Job , Cour...

CVE-2020-10199_POC-EXP

Affected versions + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version...

MAL-2026-17346 Malicious code in @bellaxchuu/privatebails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17400 Malicious code in my-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...