578 matches found
CVE-2024-52475
CVE-2024-52475 WordPress Wawp Plugin = 3.0.17 is vulnerable to Broken Authentication Account takeover Disclaimer! The information provided in this document regarding for CVE-2024-52475 is for learning and educational purposes only. We do not encourage or authorize the use of this information for...
CVE-2017-14322
CVE-2017-14322 Interspire Email Marketer emailmarketer Exploit Google Dork root@kitploit: intitle:"Control Panel" + emailmarketer Exploit using Burp Suit Add a Match and Replace for Request header like below: root@kitploit: Match: ^Cookie.$ Replace: Cookie:...
CVE-2024-3400-POC
CVE-2024-3400 RCE Test Script Overview This Python script is designed to test for a remote code execution RCE vulnerability, specifically CVE-2024-3400, which affects certain Palo Alto Networks GlobalProtect portals. The vulnerability allows unauthorized command execution via cookie manipulation...
cve-2022-23131
cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbieγ@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...
grafana-CVE-2018-15727
Grafana CVE-2018-15727 exploit Installation root@kitploit: $ go get github.com/u238/grafana-CVE-2018-15727 Usage root@kitploit: $ source go env $ $GOPATH/bin/grafana-CVE-2018-15727 ldapadmin i delete the grafanasess cookie from your browser session i set following cookies in you browser: for...
CVE-2025-14440
CVE-2025-14440 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie π¨ JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie π Description The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.4.01. This flaw...
CVE-2024-3400-poc
CVE-2024-3400 Vulnerability PoC Proof of Concept Vulnerability Description CVE-2024-3400 is a command injection vulnerability in Palo Alto firewall systems. By crafting a malicious HTTP request, an attacker can execute arbitrary commands on the target server and even gain root privileges...
CVE-2026-84652
CVE-2026-84652 is a session fixation vulnerability in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) . When a user authenticates via the "remember me" cookie, Jenkins does not rotate the session, allowing an attacker serving content on a sibling subdomain (e.g., evil.example.org for Jenkins ...
CVE-2026-77995
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On β OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...
EUVD-2026-64844
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...
CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On β OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On β OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...
CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...
CVE-2026-77995
CVE-2026-77995 is an arbitrary account takeover vulnerability in the miniOrange OAuth Client Joomla extension, affecting versions prior to 3.2.0 . The flaw is caused by the manipulation of a cookie value , allowing an unauthenticated attacker to log in as any account on the site, including admini...
PT-2026-80858
Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...
UBUNTU-CVE-2026-48551
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...
CVE-2026-60134
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges...
CVE-2026-60134
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges...
HTTP Response Splitting
Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to HTTP Response Splitting via the X-Forwarded-Prefix HTTP header. An attacker can manipulate cookie attributes by injecting arbitrary values into the Set-Cookie path attribute,...
CVE-2025-67446
Improper Authentication Authentication Bypass exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value e.g., setting it to "admin", an attacker can bypass the authentication schema and gain...
CVE-2026-31387 Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation
Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...