206 matches found
CVE-2024-43044-jenkins
Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read files to forge a remember-me cookie for an admin account and gain access to Jenkins scripting engine. Check out the full...
CVE-2023-27524
CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is running with an insecure default configuration CVE-2023-27524. The script checks if a Superset server's session cookies are signed with any well-known default Flask SECRETKEYs. The --validate flag can be...
CVE-2026-21994
CVE-2026-21994 Summary Oracle OKIT oci-designer-toolkit version 0.3.0 contains two critical misconfigurations that chain into an unauthenticated full takeover. A hardcoded Flask SECRETKEY exposed in the public repository allows any attacker to forge a valid admin session cookie ā no credentials...
POC-CVE-2014-0166
POC&EXP of CVE-2014-0166 WordPress 3.8.2 cookie forgery vulnerability Details of this vulnerability can be found athere There are three files: wpzerocookiegenerator.php POC to verify this vulnerability. It won't send any requests, just a local brute-forcer. Redefine variables to supply info and i...
CVE-2021-40903
Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass CVE: CVE-2021-40903 Date: 09/06/2021 Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Exploit Author: CQR.company / Vulnz. Vendor Homepage: https://github.com/anselal/antminer-monitor,...
CVE-2019-5420-PoC
CVE-2019-5420-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Nice argparse stuff, not a bad PoC Usage usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE...
cve-2020-10977-read-and-execute
CVE-2020-10977 read and execute About CVE-2020-10977 HackerOne Report: https://hackerone.com/reports/827052 Exploit-DB: https://www.exploit-db.com/exploits/48431 How to reproduce excecution part manually: From reading to execution About this repository getsecret.py - main script. It uses...
CVE-2026-0257
CVE-2026-0257: GlobalProtect Authentication Bypass Overview This exploit achieves unauthenticated VPN access to a Palo Alto GlobalProtect gateway/portal by forging an authentication cookie using only the server's publicly available TLS certificate. The Core Vulnerability Why It Works GlobalProtec...
CrushFTP-CVE-2024-4040-illdeed
CVE-2024-4040 ā CrushFTP Authentication Bypass Exploit This repository contains a stealthy Python proof-of-concept PoC exploit for CVE-2024-4040 , a critical vulnerability in CrushFTP v10 and below that allows an attacker to bypass authentication using a forged CrushAuth cookie and AWS-style...
CVE-2026-0257
Forge a GlobalProtect auth override cookie using the public key from TLS CVE-2026-0257 A proof-of-concept script to test a target PAN-OS GlobalProtect portal or gateway for CVE-2026-0257. The script will attempt to forge a valid authentication override cookie by iterating over the certificate cha...
Research-CVE-2023-27524
Research-CVE-2023-27524 The ASEAN Information Security Student Competition Jeopardy has temporarily concluded; my team MSECHUNT3R won second place in the Jeopardy bracket. I feel both happy and sad because this year's web challenge didn't meet my expectations, but anyway, I have a CVE to analyze ...
CVE-2025-49132-PoC
Guide to use script that exploit the Pterodactyl Path Traversal at locale.json Requirements Exposed Redis Server Panel URL Guide 1. Get access to the server configuration file, which has APPKEY and Redis Database Password + IP 2. Use forgecookie to generate a pterodactylsession cookie 3. Use that...
VulnCheck KEV: CVE-2026-61500
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's...
Kimai-CVE-2026-49865-POC
Kimai CVE-2026-52824 ā Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...
CVE-2026-92749
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...
CVE-2026-92749
SafeLine through version 9.4.1 contains an authentication bypass in its management console. The session-signing secret is derived from a time-seeded math/rand generator , allowing unauthenticated remote attackers who can bound the install timestamp to reconstruct the key offline and forge valid a...
CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...
CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...
CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...
Astra Linux ā Vulnerability in PHP 7.3
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11, when PHP processes incoming HTTP cookie values, the cookie names are url-decoded. This may result in cookies with prefixes like Host being confused with cookies that are decoded with such prefixes. As a consequence,...