462 matches found
XSSight
WARNING: This page is only for education, every malicious purpose from the users that are using it, will be punished with law rules! XSSight Cross-site Scripting XSS Cross-site Scripting XSS is an attack technique that involves echoing attacker-supplied code into a user's browser instance. A...
CVE-2019-10008
CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...
CVE-2025-51863
CVE-2025-51863 Vulnerability description ChatGPTUtil is a AI-powered chatbot assistant, providing access to both ChatGPT and an AI image generator. A Self Cross-Site Scripting Self-XSS vulnerability exists in the chat component. This can lead to cookie theft leading to remote account hijacking...
CVE-2023-22894
Exploit no autenticado de Strapi: CVE-2023-22894 Este repositorio contiene una prueba de concepto PoC del exploit para CVE-2023-22894, que permite a usuarios no autenticados filtrar información sensible y secuestrar cuentas de administrador de Strapi explotando la funcionalidad de filtrado de...
immich-exfiltration-demo
Demo de ciberseguridad: exfiltración de Immich CVE-2026-35455 Prueba de concepto de ciberseguridad para CVE-2026-35455, que demuestra la generación automatizada de claves de API y la exfiltración de datos que conduce al secuestro total de la cuenta y al acceso no autorizado persistente. Más...
CVE-2025-3604
🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Critico Pubblicato : 23 aprile 2025 Ultimo aggiornamento : 24 aprile 2025 ⚙️ Esempio di Output dello Script root@kitploit: Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to:...
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. Thes...
CVE-2026-48911
Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
EUVD-2026-51841
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
VulnCheck KEV: CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...
CVE-2026-48117
DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed accoun...
CVE-2026-48117 DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover
DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed accoun...
CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...
CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...
CVE-2026-48611
CVE-2026-48611 is a vulnerability in phpBB prior to 3.3.17 that allows unauthenticated account takeover via an authentication bypass in the login-link feature. The Nuclei template specifies an authentication bypass where the login flow trusts the OAuth provider when the auth_provider query parame...
CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...