CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit para ejecución remota de código sin autenticación en Craft CMS, escrito en Go. Inspirado en el trabajo original de c0gnit00. Cómo funciona 1. Obtiene la sesión PHP y el token CSRF mediante GET /admin/login 2. Envenena el archivo de sesión PHP...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat PUT Parcial + Deserialización RCE 📋 Resumen CVE-2025-24813 es una vulnerabilidad de alta gravedad en Apache Tomcat que permite ejecución remota de código no autenticada cuando se cumplen tres condiciones: 1. El servlet predeterminado tiene habilitado el acceso de...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 Error de reanudación de sesión en MatrixSSL 1. Descripción del error Un problema en MatrixSSL 4.5.1-open y anteriores provoca un fallo al verificar de forma segura el campo SessionID, resultando en el uso indebido de un MasterSecret todo ceros que puede descifrar datos...

CVE-2025-61686_docker

CVE-2025-61686docker 启动 1.build docker-compose up --build 2.start docker-compose up 复现流程 1.构造符合穿越条件的session └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '=' IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg 2.将构造session塞到Cookie，发送请求 └─$ curl -H 'Cookie:...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front OIDC session hijacking Front estático que ejecuta el flujo OIDC authorization code contra un Keycloak y expone el hook de secuestro de sessionid del PoC. Se sirve con nginx en el puerto 5174 para uso del equipo. Levantarlo en la VPS cd vps/pocCVE0264 docker compose up -d...

CitrixBleedCVE-2026-8452-2025-5777

Herramienta de Explotación CitrixBleed - CVE-2025-5777 y CVE-2026-8452. Lectura remota de memoria no autenticada desde Citrix NetScaler ADC y Gateway. Roba tokens de sesión de administrador, extrae hashes de nsroot, extrae secretos y evita MFA. Exploit en Python 3 con análisis completo de memoria...

CVE-2026-105131

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2018-10933_ssh

CVE-2018-10933 para probar este código: obtén la versión vulnerable de libssh desde la página principal: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz descomprime y compila, luego ve al directorio example, hay un servidor sshd simple usando libssh llamado: samplesshd-cb ejecuta este simple...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

EUVD-2026-92060

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131

The mayswind ezBookkeeping software (versions 1.2.0 before 2.0.1) is vulnerable to a privilege escalation flaw in the /api/v1/tokens/refresh.json endpoint. The root cause is that the TokenRefreshHandler fails to verify the token type, allowing an attacker with an API token to exchange it for a 30...

Loracrack

Loracrack - Cracker de sesiones LoRaWAN Un PoC para explotar claves de aplicación débiles o compartidas Creado por Sipke Mellema de Applied Risk Esto es una Prueba de Concepto para demostrar los peligros de usar la misma AppKey en múltiples nodos LoRaWAN. Este repositorio contiene un conjunto de...

PT-2026-104598

Name of the Vulnerable Software and Affected Versions ezBookkeeping versions 1.2.0 through 2.0.0 Description A privilege escalation issue exists where attackers possessing an API token can obtain a full session token. This occurs because the TokenRefreshHandler function fails to verify the token...

CVE-2026-105131: Incorrect Authorization

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105208: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

Debian dsa-6542 : ruby-rack-session - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6542 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6542-1 [email protected] https://www.debian.org/security/ Moritz...

PT-2026-104632

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

PT-2026-104637

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...