CVE-2025-51858

CVE-2025-51858 Descrizione della vulnerabilità ChatPlayground.ai è una popolare applicazione web per confrontare modelli di intelligenza artificiale. Esiste una vulnerabilità di Cross-Site Scripting XSS nel componente chat. Ciò può portare al furto del token JWT e al dirottamento remoto...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Exploit Automatico - Guida all'Uso Cosa Fa Questo Script Automatizza l'intera catena di account takeover in 4 gruppi di richieste HTTP: 1. Verifica della Vulnerabilità - Conferma che il target è vulnerabile 2. Enumerazione Email - Estrae l'email dell'amministratore tramite oracle...

CVE-2025-51859

CVE-2025-51859 Descrição da vulnerabilidade O Chaindesk, um aplicativo web para construção de Agentes de IA, é vulnerável a Cross-Site Scripting XSS Armazenado em seu componente de chat de agentes. Um atacante pode obter execução arbitrária de scripts no lado do cliente ao criar um agente de IA...

CVE-2026-45745

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

CVE-2026-42239

Budibase (backend-core, budibase:auth cookie) is affected prior to version 3.35.10. The issue is that the budibase:auth cookie is set HTTPOnly: false, lacks secure: true and sameSite, allowing access to the JWT session token via document.cookie. This enables any XSS to escalate to full account ta...

AIBOX Cross Site Scripting

AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote account hijacking...

next-auth security vulnerability

next-auth is the complete open source authentication solution for Next.js applications. A security vulnerability exists in versions of next-auth prior to 4.24.5, which stems from an attacker being able to obtain a NextAuth.js-issued JWT from an interrupted OAuth login process status, PKCE, or...