CVE-2025-56289

code-projects Document Management System 1.0 has a Cross Site Scripting XSS vulnerability, where attackers can leak admin's cookie information by entering malicious XSS code in the Company field when adding files...

CVE-2025-56289

code-projects Document Management System 1.0 has a Cross Site Scripting XSS vulnerability, where attackers can leak admin's cookie information by entering malicious XSS code in the Company field when adding files...

PT-2025-37988

Name of the Vulnerable Software and Affected Versions: code-projects Food Ordering Review System version 1.0 Description: The Food Ordering Review System is susceptible to a Cross Site Scripting XSS issue within the registration function. An attacker can inject malicious JavaScript code as a...

PT-2025-37995

Name of the Vulnerable Software and Affected Versions: code-projects Document Management System version 1.0 Description: The Document Management System contains a Cross Site Scripting XSS flaw. An attacker can exploit this issue to leak an administrator's cookie information by injecting malicious...

CVE-2025-56289

CVE-2025-56289 affects Code-Projects Document Management System v1.0. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by failure to filter yet in the Company field during file uploads, allowing an attacker to exfiltrate the administrator’s cookies. Reported impact is limited to cook...

CVE-2024-30268

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit...

WordPress LiteSpeed Cache Cookie Theft Exploit

This Metasploit module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a WordPress plugin that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when the Debug Logging feature is enabled, the plugin will log admin...

Wordpress LiteSpeed Cache plugin cookie theft

This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when the Debug Logging feature is enabled, the plugin will log admin cookies to the...

WordPress LiteSpeed Cache Cookie Theft

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress LiteSpeed Cache plugin cookie theft', 'Description' = %q This module exploits an unauthenticated account takeover vulnerability in...

The vulnerability of the GLPI system’s handling of requests and incidents is related to improper cancellation of input data during the generation of web pages. This allows a malicious user to gain unauthorized access to GLPI administrator’s cookie files.

The vulnerability of the GLPI request and incident handling system lies in the fact that the registration key is not properly encrypted on the configuration page for the registration key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...

CVE-2024-27179

Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL...

CVE-2024-27179 Session disclosure inside the log files

Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL...

CVE-2024-27179 Session disclosure inside the log files

Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL...

PT-2024-21713 · Toshiba Tec · Toshiba Tec E-Studio Multi-Function Peripheral +35

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves admin cookies being written in clear-text in logs. This allows an attacker to retrieve the cookies and bypass the authentication...

PT-2024-3608 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.3.x Description: A reflected cross-site scripting issue in Cacti allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This is related to the lack of measures to...

PT-2023-31979 · Drupal · Drupal Json:Api Module

Name of the Vulnerable Software and Affected Versions: Drupal JSON:API module affected versions not specified Description: In certain scenarios, Drupal's JSON:API module will output error backtraces, potentially causing sensitive information to be cached and made available to anonymous users,...

CVE-2023-2637

Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie...

CVE-2022-41327

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

Protect

A cleartext transmission of sensitive information vulnerability CWE-319 in FortiOS & FortiProxy may allow an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands...

Moodle vulnerable to stored Cross-site Scripting

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting XSS due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability may lead an attacker to steal admin and all user account cookies by storin...