CVE-2026-118394

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

EUVD-2026-114802

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2026-118394

The Gitea OAuth2 userinfo endpoint (/login/oauth/userinfo) is vulnerable to private group disclosure due to incorrect authorization logic. The system incorrectly re-parsed the Authorization header as an OAuth2 access token instead of using the scope of the authenticating credential. Consequently,...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 Vulnerability Tester Description This PowerShell script is designed for authorized penetration testing purposes only. It tests Fortinet FortiWeb appliances for CVE-2025-25257, an unauthenticated SQL injection vulnerability in the /api/fabric/device/status endpoint...

CVE-2023-20198

CVE-2023-20198 CVE-2023-20198 Checkscript based on: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ Including the updated where there is an Authorization header to check for the known implant. !! Upgraded to look for upgraded implant The script checks length of...

cve-2025-25257

CVE-2025-25257 - Experimentation Environment Experiment Architecture the environment simulates vulnerable FortiWeb components Vulnerable endpoint: /api/system/fabric/config Injection vector: HTTP Header Authorization: Bearer Mechanism: Direct SQL concatenation Python f-string Authentication: None...

CVE-2021-38647

CVE-2021-38647 AKA "OMIGOD" A Zeek package which detects CVE-2021-38647 AKA OMIGOD exploit attempts. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647...

CVE-2026-118394: Gitea: The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public…

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

PT-2026-134879

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2022-30114

Fastweb FastGate 'cmproxy' buffer overflow CVE-2022-30114 Introduction This script is a Proof of Concept PoC of CVE-2022-30114 and causes a reboot of Fastweb FastGate home routers, both GPON and VDSL2 version. CVE-2022-30114 is a heap-based buffer overflow in the 'cmproxy' executable, a program...

CVE-2025-25257

🚨 CVE-2025-25257 – FortiWeb SQLi to RCE Critical SQL Injection → Webshell Execution Discovered and weaponized by 0xgh057r3c0n 🧠 Vulnerability Overview CVE-2025-25257 affects FortiWeb systems exposing the endpoint /api/fabric/device/status, which fails to properly sanitize Authorization header...

CVE-2025-25257

CVE-2025-25257 - FortiWeb Vulnerability Checker & Exploit A Python-based tool for checking and exploiting CVE-2025-25257 vulnerability in FortiWeb devices. This vulnerability allows SQL injection and remote code execution through a crafted Authorization header. 📋 Description CVE-2025-25257 is a...

cve-2020-15956

cve-2020-15956 ACTi NVR 2.3 Standard/Professional Server and ACTi NVR3 Standard/Professional Server allows remote unauthenticated attackers to conduct a denial of service. To exploit this vulnerability merely send a malformed authorization header payload of at least 760-bytes to the Media Server...

FortiWeb-CVE-2025-52970-Authentication-Bypass

🚨 FortiWeb Authentication Bypass → Remote Code Execution 📌 Overview This repository demonstrates an authentication bypass in FortiWeb that can be chained to achieve Remote Code Execution RCE. The exploit leverages a vulnerable endpoint to inject SQL payloads, upload a webshell, and execute comman...

CVE-2021-38647-noimages

CVE-2021-38647 AKA "OMIGOD" A Zeek package which detects CVE-2021-38647 AKA OMIGOD exploit attempts. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647...

POC-CVE-2023-32681

POC for CVE-2023-32681 This is a Python 3 implementation of CVE-2023-32681, affecting clients using the requests version = 2.30.0. As per https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4 whenever redirection 3xx is issued by the server then user-agent should modify the request to remove...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

amt_auth_bypass_poc

Intel AMT authentication bypass example This is a Proof-of-Concept code that demonstrates the exploitation of the CVE-2017-5689 vulnerability. It is essentialy a mitmproxy script that simply blanks an Authorization header "response" field. Example usage: mitmdump -p 8080 -dd --no-http2 -s...