CVE-2018-7935

CVE-2018-7935 POC grab vaild Session first curl http://192.168.8.1/html/index.html | grep SessionID Instructions: Edit exploit.py , insert grabbed SessionID Vulnerability Status : Acknowledgemnt Recieved & Patch is released...

CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

EUVD-2026-83300

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

CVE-2021-43857

CVE-2021-43857 CVE-2021-43857gerapy命令执行 免责声明 root@kitploit: 脚本仅供学习参考，请勿恶意攻击他人网站， 如违法乱纪，造成一切后果由使用者自行承担 技术无罪，与作者无关 使用脚本默认同意以上说明！ --Author:lowkey0808 使用方式 root@kitploit: -h, --help show this help message and exit -u url -U 登录用户 -P 登录密码 -r 反弹shellIP -p 反弹端口...

Security Bulletin: IBM Sterling File Gateway is Vulnerable to Authentication Bypass (CVE-2026-75878)

Summary IBM Sterling File Gateway has addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-75878 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an...

PT-2026-93123

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-54175 backpack/crud: Unverified password change in MyAccountController via mass assignment

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST...

BIT-TOMCAT-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-86746

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

PT-2026-78931

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description An expression injection issue exists in the link preview rendering of the resource-locator field. The editor directly splices the...

CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-61807

Snipe-IT versions before 8.6.2 are vulnerable to stored DOM XSS: a crafted manufacturer/supplier name flows into data-selected-count-id in bootstrap-table.blade.php, is decoded client-side, and is injected via jQuery .after(), executing JS in authenticated users' sessions. Fix is version 8.6.2. N...

EUVD-2026-62626

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-40509

OpenEMR before 8.3.0 is affected by a cross-site request forgery (CSRF) vulnerability in the DICOM viewer . The web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a malicious URL that causes an authenticated user holding...

Origin Validation Error

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or Install Tool endpoints with an authenticated victim’s session by sending...

PT-2026-69156

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.81.1 lakeFS Enterprise versions prior to 1.84.0 Description The Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commi...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the condition.config process. An attacker can execute arbitrary operating system commands, read sensitive...