Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

TotalCMS-Arbitrary_File-Upload--XSS_Steal_Cookies---TotalDepot

TotalCMS Carga Arbitraria de Archivos - XSS y robo de cookies Autor: Sergio Descripción: TotalCMS está afectado por la vulnerabilidad de Carga Arbitraria de Archivos - XSS que permite Cross-Site Scripting XSS y también el robo de cookies de sesión. Vectores de ataque: Una vulnerabilidad en la...

OESA-2026-4038 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctpstreamupdate is only invoked when the association is moved into COOKIEWAIT during association...

OESA-2026-4035 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4036 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4034 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

SubGPT

SubGPT 会查看你已为某个域名发现的子域名，并使用 BingGPT 找到更多子域名。最棒的是？它完全免费！ 以下子域名是由该工具以 这些 30 个子域名作为输入发现的。 call-prompts-staging.example.com dclb02-dca1.prod.example.com activedirectory-sjc1.example.com iadm-staging.example.com elevatenetwork-c.example.com 如果你喜欢我的工作，可以支持我，最低只需 1 美元，在此 : 安装与配置 安装 通过 pip（推荐）：pip instal...

DumpChromeSecrets

!IMPORTANT 此项目不再维护。请改用DumpBrowserSecrets，它支持 Chrome、Edge、Brave、Firefox、Opera、Opera GX 和 Vivaldi。 DumpChromeSecrets 从现代 Chrome 版本中提取数据，包括刷新令牌、Cookie、已保存的凭据、自动填充数据、浏览历史记录和书签。 快速链接 Maldev Academy 主页 Maldev 数据库 恶意软件开发课程大纲 攻击性钓鱼操作课程大纲 勒索软件内部原理、模拟与检测课程大纲 工作原理 本项目包含两个组件： 1. 可执行文件（DumpChromeSecrets.exe） ...

DAHUA_AUTH-BYPASS-CVE-2021-33044

Simulación de explotación de Dahua Authentication Bypass PoC CVE-2021-33044 Resumen Las cámaras IP Dahua son dispositivos IoT ampliamente utilizados en sistemas de vigilancia de seguridad. Debido a que se implementan con frecuencia en redes internas o se accede desde Internet, las vulnerabilidade...

DVRFaultNET

DVRFaultNET .NET 控制台应用程序，利用 DVR CVE-2018-9995 漏洞 使用方法 启动后，系统会提示您输入 DVR 摄像头的 URL。程序会在 URL 后添加 ?opt=user&cmd=list，并发送包含 "Cookie:uid=admin" 标头的请求，然后服务器返回一个 JSON 字符串，其中包含所有用户的凭据。...

Linux Distros Unpatched Vulnerability : CVE-2026-67236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing...

CVE-2026-91766: Exposure of Sensitive Information to an Unauthorized Actor

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CVE-2026-67234: Improper Input Validation

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

Linux Distros Unpatched Vulnerability : CVE-2026-67234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or...

PT-2026-98910

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.7 RabbitMQ versions 4.3.0 through 4.3.1 Description The get auth mechanism/1 function uses term to binary/1 on the strict auth mechanism or preferred auth mechanism atom when clearing cookies. This process...

PT-2026-99018

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

CVE-2025-8730

CVE-2025-8730 – Belkin F9K1009/F9K1010 中的身份验证绕过 作者：Byte Reaper 描述： 此仓库包含一个针对 CVE‑2025‑8730 的漏洞利用代码，这是一个影响 Belkin F9K1009 和 F9K1010 路由器 Web 界面的严重身份验证绕过漏洞。 该漏洞存在于 /login.htm 文件的会话验证逻辑中，不当处理的 cookie 或精心构造的请求允许攻击者绕过登录检查，无需有效凭据即可完全访问管理界面。 此漏洞使远程攻击者（具有网络访问权限）能够： 访问敏感配置数据 修改路由器设置 部署进一步的有效载荷以实现持久化或横向移动...

CVE-2020-26732

CVE-2020-26732 SKYWORTH GN542VF, versión de hardware 2.0 y versión de software 2.0.0.16, no establece el indicador Secure para la cookie de sesión en una sesión HTTPS Descripción SKYWORTH GN542VF, versión de hardware 2.0 y versión de software 2.0.0.16, no establece el indicador Secure para la...

CVE-2021-44142

Comprobador de vulnerabilidad CVE-2021-44142 Una herramienta para comprobar si un servidor Samba es vulnerable a CVE-2021-44142 Antecedentes CVE-2021-44142 es una lectura y escritura fuera de los límites del montículo en el módulo vfsfruit de Samba, utilizada en Pwn2Own Austin 2021 contra el...

USN-8820-1 curl vulnerabilities

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-13608 Stephan...