CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CVE-2020-29666

CVE-2020-29666 Directory Listing Suggested description In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value...

CVE-2021-46067

CVE-2021-46067 Exploit Title: Vehicle Service Management System - 'Multiple' Cookie Stealing Leads to Full Account Takeover Exploit Author: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRITICAL References:...

AZL-104966 CVE-2026-94282 affecting package libXi 1.8.1-1

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

DEBIAN-CVE-2026-94282

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

CVE-2026-94282

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

CVE-2026-94282 Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

EUVD-2026-88168

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

poisontap

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers Created by @SamyKamkar || https://samy.pl When PoisonTap Raspberry Pi Zero & Node.js is plugged into a locked/password protected computer, it: emulates an Ethernet device over USB or Thunderbolt...

CodeIgniterXor

CodeIgniterXor PoC script to decode CodeIgniter = 2.1.4 session cookies that use xorencode method. Full details availalbe on on the following blog post: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Usage break.py This is the main script, and given a target URI will...

CVE-2026-74252

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass J2Commerce comj2store ≤ 4.1.5 — Unauthenticated Attacker Stores XSS Payload That Executes Automatically in Administrator Browser on Page Load SUMMARY J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the gues...

CVE-2016-4437

shiro-1.2.4 Vulnerability Tool Decrypt rememberMe value and export corresponding class file Usage xk-mt-rememberMe解码.py Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After...

CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2026-0257

🚨 CVE-2026-0257 – PAN-OS GlobalProtect Authentication Bypass Security research, technical analysis, detection guidance, IOC collection, and defensive validation resources for CVE-2026-0257. 📌 Overview CVE-2026-0257 is an authentication bypass vulnerability affecting Palo Alto Networks GlobalProte...

CVE-2025-63498

Stored XSS in cookie Alinto/SOGo Researchers: Daniil Khomichenok, Alexander Klimenko Affected Versions var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code of login remember set-cookie which accepts XSS injections as a paramteter value: if...

CVE-2024-4367-POC-PDFJS

CVE 2024 4367: PoC pour l'exploitation de XSS Cross-Site Scripting 1. Displaying an Alert XSS Trigger Another exploitation example consists of injecting a simple alert message to check if the attack works. python poc.py "alert'XSS exploit triggered';" Explanation : This code injects an alert...

CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】account takeover via XSS Detail There is a vulnerability that causes XSS when downloading files. XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks. This vulnerability is marked as CVE-2024-46278:...

CVE-2024-34568

Exploit Title: LetterPress = 1.2.1 - Cookie Stealing Vulnerability Exploit Author: SANU P.L CVE: CVE-2024-34568 CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L References: https://nvd.nist.gov/vuln/detail/CVE-2024-34568...

CVE-2022-45059-demo

CVE-2022-45059-demo Varnish Cache releases 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 and 7.2.0 have a request smuggling vulnerability where an attacker can request that the content-length header is made hop-by-hop. This is a demo consisting of a Spring Boot web application running behind a...