TBK DVR4104/DVR4216 Devices - Authentication Bypass

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

SafeGuard for Privileged Passwords < 7.5.2 - Authentication Bypass

One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations VMware or HyperV. The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2. id: CVE-2024-45488 info: name: SafeGuard for...

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

H3C SSL VPN <=2022-07-10 - Cross-Site Scripting

H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang. id: CVE-2022-35416 info: name: H3C SSL VPN =2022-07-10 - Cross-Site Scripting author: 0x240x23elu severity: medium description: | H3C SSL VPN 2022-07-10 and prior contains...

PrestaShop lgcookieslaw - SQL Injection

The EU Cookie Law GDPR Banner + Blocker PrestaShop module before 2.1.3 allows blind SQL injection via the lglaw or lgcookieslaw cookie used to store user consent choices. id: CVE-2022-44727 info: name: PrestaShop lgcookieslaw - SQL Injection author: mastercho severity: critical description: | The...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

CVE-2024-55211

CVE-2024-55211 Vulnerabilità di autenticazione basata su cookie in Tk-Rt-Wr135G Fornitore interessato : Think Technology Prodotto interessato : Wireless Router Ac 1199Mbps Tk-Rt-Wr135G Versione interessata : Firmware V3.0.2-X000 Descrizione La vulnerabilità consente di bypassare il modulo di logi...

CVE-2020-25627

CVE-2020-25627 Gespeichertes XSS über den Parameter moodlenetprofile im Benutzerprofil Mein PoC zu dieser CVE Benutzeranforderung: Student oder die Website für die Registrierung XSS im Parameter moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through...

CVE-2025-64714-privatebin-2.0.2-PoC

CVE-2025-64714 — PrivateBin: Inclusione Locale di File tramite Path Traversal del Cookie Template Gravità: Media CVSS v3.1: 5.8 Vettore: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Versioni interessate: PrivateBin = 1.7.7 Versione corretta: 2.0.3 CWE: CWE-23 Path Traversal relativo, CWE-73 Controllo...

CVE-2023-6063-PoC

PoC per CVE-2023-6063: WP Fastest Cache 1.2.2 Iniezione SQL Cieca Non Autenticata -red Una Proof of Concept per CVE-2023-6063, una vulnerabilità di iniezione SQL cieca basata sul tempo in WP Fastest Cache ≤1.2.2. Estrae password hashate userpass ed email useremail dalla tabella wpusers abusando d...

CVE-2022-23131

CVE-2022-23131 Vulnerabilità di bypass dell'autenticazione del frontend Zabbix Descrizione Questo script è un exploit per CVE-2022-23131 , una vulnerabilità nel meccanismo SSO Single Sign-On di Zabbix. La vulnerabilità consente a un attaccante di aggirare l'autenticazione tramite un cookie...

CVE-2020-10977

GitLab v12.4.0-12.8.1 RCE Basato interamente su https://github.com/dotPY-hax/gitlabRCE, che non funzionava per me e il parsing HTML sembrava macchinoso, così l'ho riscritto in js. Utilizzo Avvia un handler di reverse shell nel modo consueto, quindi esegui questo script con: root@kitploit:...

CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 è una vulnerabilità nel plugin LiteSpeed Cache, un popolare plugin WordPress. Questa vulnerabilità riguarda la gestione delle sessioni in LiteSpeed Cache, consentendo agli attaccanti di ottenere un accesso non autorizzato a dati sensibili...

CVE-2020-6364

CVE-2020-6364 Execução remota de código no CA APM Team Center Wily Introscope. Aviso original Uma vulnerabilidade de desserialização no CA APM Team Center leva à execução remota de código não autenticada no servidor. Ao autenticar no servidor, um cookie é retornado começando com a infame string...