CVE-2024-43044-jenkins

Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read files to forge a remember-me cookie for an admin account and gain access to Jenkins scripting engine. Check out the full...

CVE-2023-27524

CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is running with an insecure default configuration CVE-2023-27524. The script checks if a Superset server's session cookies are signed with any well-known default Flask SECRETKEYs. The --validate flag can be...

CVE-2026-21994

CVE-2026-21994 Summary Oracle OKIT oci-designer-toolkit version 0.3.0 contains two critical misconfigurations that chain into an unauthenticated full takeover. A hardcoded Flask SECRETKEY exposed in the public repository allows any attacker to forge a valid admin session cookie — no credentials...

POC-CVE-2014-0166

POC&EXP of CVE-2014-0166 WordPress 3.8.2 cookie forgery vulnerability Details of this vulnerability can be found athere There are three files: wpzerocookiegenerator.php POC to verify this vulnerability. It won't send any requests, just a local brute-forcer. Redefine variables to supply info and i...

CVE-2021-40903

Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass CVE: CVE-2021-40903 Date: 09/06/2021 Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Exploit Author: CQR.company / Vulnz. Vendor Homepage: https://github.com/anselal/antminer-monitor,...

CVE-2019-5420-PoC

CVE-2019-5420-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Nice argparse stuff, not a bad PoC Usage root@kitploit: usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY...

cve-2020-10977-read-and-execute

CVE-2020-10977 read and execute About CVE-2020-10977 HackerOne Report: https://hackerone.com/reports/827052 Exploit-DB: https://www.exploit-db.com/exploits/48431 How to reproduce excecution part manually: From reading to execution About this repository getsecret.py - main script. It uses...

CVE-2026-0257

CVE-2026-0257: GlobalProtect Authentication Bypass Overview This exploit achieves unauthenticated VPN access to a Palo Alto GlobalProtect gateway/portal by forging an authentication cookie using only the server's publicly available TLS certificate. The Core Vulnerability Why It Works GlobalProtec...

CrushFTP-CVE-2024-4040-illdeed

CVE-2024-4040 — CrushFTP Authentication Bypass Exploit This repository contains a stealthy Python proof-of-concept PoC exploit for CVE-2024-4040 , a critical vulnerability in CrushFTP v10 and below that allows an attacker to bypass authentication using a forged CrushAuth cookie and AWS-style...

Kimai-CVE-2026-49865-POC

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

CVE-2026-0257

Forge a GlobalProtect auth override cookie using the public key from TLS CVE-2026-0257 A proof-of-concept script to test a target PAN-OS GlobalProtect portal or gateway for CVE-2026-0257. The script will attempt to forge a valid authentication override cookie by iterating over the certificate cha...

Research-CVE-2023-27524

Research-CVE-2023-27524 The ASEAN Information Security Student Competition Jeopardy has temporarily concluded; my team MSECHUNT3R won second place in the Jeopardy bracket. I feel both happy and sad because this year's web challenge didn't meet my expectations, but anyway, I have a CVE to analyze ...

CVE-2025-49132-PoC

Guía para usar el script que explota la Path Traversal de Pterodactyl en locale.json Requisitos Servidor Redis expuesto URL del panel Guía 1. Obtén acceso al archivo de configuración del servidor, que contiene la APPKEY y la contraseña de la base de datos Redis + IP 2. Usa forgecookie para genera...

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749

SafeLine through version 9.4.1 contains an authentication bypass in its management console. The session-signing secret is derived from a time-seeded math/rand generator , allowing unauthenticated remote attackers who can bound the install timestamp to reconstruct the key offline and forge valid a...

CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11, when PHP processes incoming HTTP cookie values, the cookie names are url-decoded. This may result in cookies with prefixes like Host being confused with cookies that are decoded with such prefixes. As a consequence,...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...