178 matches found
CVE-2025-55449-AstrBot-RCE
Introducción AstrBot=3.5.17 tiene un JWT secret hardcodeado en el código fuente, lo que permite subir plugins arbitrariamente y lograr RCE Uso root@kitploit: python main.py 'http://127.0.0.1:6185' Código fuente https://github.com/AstrBotDevs/AstrBot.git...
JFrog Artifactory Access Blank Join Key Authentication Bypass
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...
OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...
Tautulli <= 2.16.1 - Path Traversal
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...
CVE-2022-45771
CVE-2022-45771 El PwnDoc es vulnerable tanto a path traversal como a inclusión local de archivos LFI, lo que permite a usuarios no privilegiados revelar secretos JWT y lograr ejecución de código. Requisitos: Un atacante tiene una cuenta válida con el rol user La aplicación tiene una plantilla de...
CVE-2025-8570
CVE-2025-8570 BeyondCart Connector = 2.1.0 - Configuración faltante del secreto JWT para escalada de privilegios no autenticada 🚨 BeyondCart Connector = 2.1.0 - Escalada de privilegios JWT CVE-2025-8570 🛡️ Resumen de la vulnerabilidad El plugin BeyondCart Connector para WordPress, en las versiones...
CVE-2026-53519
Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal Lab tai hien lo hong pre-auth path traversal via/dashboard.. prefix confusion trong Nezha Dashboard, dan toi leak jwtsecretkey - forge JWT - chiem quyen admin. Moi truong Docker, tach A/B theo version de so sanh vuln vs patched...
CVE-2026-79575
CVE-2026-79575 affects yfexam-exam v2.0 , where the JWT signing secret is derived from the username and the current month rather than a random server-side key. This weak derivation makes the secret easily recoverable via a bruteforce attack , allowing an unauthenticated network attacker to forge ...
EUVD-2026-72912
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...
CVE-2025-55449
CVE-2025-55449 - Vulnerabilidad de Ejecución Remota de Código RCE en AstrBot Resumen Este repositorio contiene un exploit de prueba de concepto para CVE-2025-55449 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en AstrBot. La vulnerabilidad permite a un atacante ejecutar código...
CVE-2025-68860
WordPress Mobile Builder = 1.4.2 - Autenticación Rota CVE-2025-68860 Descripción El plugin WordPress Mobile builder versión 1.4.2 y anteriores tiene una vulnerabilidad de Autenticación Rota que permite a un atacante crear un token JWT válido con el secreto predeterminado "examplekey" y autenticar...
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-85391
Peppermint through version 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml, also referenced in apps/api/src/lib/jwt.ts. This allows unauthenticated attackers to forge session tokens for arbitrary user IDs and access protected endpoints without valid credentials. The vulnerabil...
EUVD-2026-70668
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-78062
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...
CVE-2026-78062
CVE-2026-78062 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability resides in the JWT Secret Handler component, specifically the envSchema.parse function in lib/config.ts. Manipulation of the BETTER_AUTH_SECRET argument results in hard-coded credentials , enabling remote unauthenticat...
EUVD-2026-64631
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...
CVE-2026-78062 vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...
CVE-2026-78062 vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...
