CVE-2026-49975

CVE-2026-49975 HTTP/2 Бомба PoC Инструмент для воспроизведения удаленной уязвимости отказа в обслуживании HTTP/2 Обзор уязвимости CVE-2026-49975 — это уязвимость отказа в обслуживании DoS в протоколе HTTP/2, затрагивающая популярные веб-серверы. Уязвимость была обнаружена компанией Calif с...

cve-2025-29927-lab

CVE-2025-29927 실습 환경 CVE-2025-29927에 대한 최소 재현 실습 환경입니다. — Next.js 미들웨어 인증 우회 CVSS 9.1. 관련 자료: Medium의 N-Day 분석 글 이 실습 개요 취약한 Next.js 15.2.2 애플리케이션으로, 쿠키로 보호된 /dashboard 경로가 있습니다. 미들웨어 인증 검사는 단일 HTTP 헤더 하나를 보내는 것만으로 우회할 수 있습니다 — 자격 증명이 필요하지 않습니다. 요구 사항 Node.js 18+ 설정 root@kitploit: git clone...

CVE-2026-75757

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

MAL-2026-15602 Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-23550

root@kitploit: ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB 인증 우회 간단한 PoC 인증 우회. 브라우저를 통해 접근하려면 스크립트의 USERAGENT 변수를 브라우저에 표시된 값에 맞게 변경하는 것을 잊지 마세요. 쿠키 편집기를 사용하여 sid 및 u 값을 교체하세요. 영향을 받는 버전: phpBB 3.3.16 이하 + 4.0.0-a2 root@kitploit: phpbb python3 exploit.py https://localhost:8000 joushk + Target: https://localhost:8000 + Target usernam...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

EUVD-2026-68324

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757

ash_admin (ash-project) is vulnerable to session/actor shadowing via a flawed client-side cookie reader. The JavaScript reads state cookies (e.g., actor_authorizing, actor_domain) using an unanchored regex (new RegExp(name + "=([^;]+)")) against document.cookie, so any cookie whose name merely en...

CVE-2022-35497

В Trimble TM4WEB =22.2.0 из-за неправильной конфигурации безопасности идентификаторов сессии существует возможность восстановить действительные cookie сессии через отражённый межсайтовый скриптинг, затрагивающий конечную точку внешнего просмотрщика документов. В частности, три cookie, используемы...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Бомба ★ CVE-2026-49975 HTTP/2 Бомба PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Обзор CVE-2026-49975 — это уязвимость типа Отказ в обслуживании DoS в Apache HTTP Server. Уязвимость возникает в пути обработки запросов HTTP/2, где...

CVE-2026-0257

Создание поддельного cookie для обхода аутентификации GlobalProtect с использованием открытого ключа из TLS CVE-2026-0257 Скрипт для проверки целевого портала или шлюза PAN-OS GlobalProtect на уязвимость CVE-2026-0257. Скрипт пытается создать поддельный cookie для обхода аутентификации, перебирая...

SUSE SLES12 Security Update : kernel (Live Patch 85 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3820-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3820-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.320 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2025-56798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges vi...

PT-2026-83851

Name of the Vulnerable Software and Affected Versions WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions prior to 4.4.2 Description An unauthenticated file upload flaw allows the unrestricted upload of files with dangerous types, which could enable the use of malicious files on the syste...

Linux Distros Unpatched Vulnerability : CVE-2026-47889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8...

CVE-2016-5983

CVE-2016-5983 IBM WebSphere десериализация недоверенных данных - IBM WebSphere 7,8,8.5,9 Ссылка на оригинальный источник: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Заголовок: IBM WebSphere десериализация недоверенных данных Приложение...

SealSecurityAssignment

SealSecurityAssignment CVE-2023-26136 취약점 연구 취약점 연구: CVE-2023-26136 설명: tough-cookie 패키지 버전 4.1.3 미만은 rejectPublicSuffixes=false 모드에서 CookieJar를 사용할 때 쿠키를 부적절하게 처리하여 프로토타입 오염Prototype Pollution에 취약합니다. 이 문제는 객체가 초기화되는 방식에서 발생합니다. https://nvd.nist.gov/vuln/detail/CVE-2023-26136 소개: 프로토타입 오염Prototy...