CVE-2019-19609-EXPLOIT

CVE-2019-19609-EXPLOIT Exploit for CVE-2019-19609 in Strapi Remote code execution in strapi-3.0.0-beta.17.7 or earlier. I was faced with a scenario with this vulnerability, but without a public exploit. I decided to create my own and share it here. Instalation git clone...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...

Alibab-Nacos-Unauthorized-Reset-PWD

Vuln Impact An issue has been discovered in Nacos affecting Nacos = 2.2.0. When a user uses the default JWT Key, it will cause an attacker to reset the password of any user and take over the user account. Vuln Product Nacos = 2.2.0 version Vulnerability reappearance Step 1：Get username can use ol...

CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

CVE-2019-19609

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Execution well, I didnt found any exploit for CVE-2019-19609 so I wrote one. :/ Usage python3 exploit.py A video https://youtu.be/alhZJmuUd2s More Information https://hack-fast.herokuapp.com/cve/CVE-2019-19609...

Damn-Vulnerable-Bank

Damn Vulnerable Bank Guía: https://rewanthtammana.com/damn-vulnerable-bank/ Acerca de la aplicación Damn Vulnerable Bank está diseñada como una aplicación android intencionalmente vulnerable. Todos los detalles están documentados en la guía, aquí. Próximas Sesiones NoNameCon...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...

ls-poc

CVE-2026-30368 Proof of concept !IMPORTANT This is patched and now requires credentials, use the workaround to perform actions on yourself. Introduction CVE-2026-30368 allows an attacker to control student devices via a weak authentication flaw in Lightspeed Classroom management. The POC poc.js...

TokenBreaker

TokenBreaker Token Breaker se centra en 2 vulnerabilidades particulares relacionadas con tokens JWT. None Algorithm RSAtoHMAC Consulte este enlace para conocer más sobre la vulnerabilidad y cómo un atacante puede falsificar los tokens. Pruebe esta vulnerabilidad aquí Uso de TheNone usage:...

CVE-2026-1529

CVE-2026-1529 Keycloak Exploit Tool CVE-2026-1529 : Keycloak - Unauthorized organization registration via improper invitation token validation ⚠️ WARNING : This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. 📋 Table of...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Members : Abhishek Rungta, Shubham Saini, Siddhant Sood Environment Setup A linux VM Such as Ubuntu 20.04 Minikube for local deploymnet of kubernetes Any of these older versions1.0.x— 1.9.x, 1.10.0—1.10.10,1.11.0—1.11.4,1.12.0—1.12.2 Run the exploit We have...

CVE-2019-20933

CVE-2019-20933 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret. see https://nvd.nist.gov/vuln/detail/CVE-2019-20933 For more details PoC This PoC exploit...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

CVE-2019-19609

CVE-2019-19609 Strapi Ejecución Remota de Código Uso python3 exploit.py rhost jwt url lhost Exploit POC https://bittherapy.net/post/strapi-framework-remote-code-execution/...

Strapi-RCE

Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...

CVE-2019-19609-POC-Python

The script will try to reset the password to the one declared in the "updatedpass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can...

CVE-2026-101052

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

EUVD-2026-88217

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...