CVE-2022-45771

CVE-2022-45771 El PwnDoc es vulnerable tanto a path traversal como a inclusión local de archivos LFI, lo que permite a usuarios no privilegiados revelar secretos JWT y lograr ejecución de código. Requisitos: Un atacante tiene una cuenta válida con el rol user La aplicación tiene una plantilla de...

CVE-2026-90945

Crawlab versions through 0.6.3 contain a critical authentication bypass caused by a hard-coded HMAC-SHA256 secret used for JWT token signing. Because the secret cannot be overridden via configuration or environment variables, an unauthenticated network attacker can forge valid administrator token...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2025-55449

CVE-2025-55449 - Vulnerabilidad de Ejecución Remota de Código RCE en AstrBot Resumen Este repositorio contiene un exploit de prueba de concepto para CVE-2025-55449 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en AstrBot. La vulnerabilidad permite a un atacante ejecutar código...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - Autenticación Rota CVE-2025-68860 Descripción El plugin WordPress Mobile builder versión 1.4.2 y anteriores tiene una vulnerabilidad de Autenticación Rota que permite a un atacante crear un token JWT válido con el secreto predeterminado "examplekey" y autenticar...

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

CVE-2025-55449-AstrBot-RCE

Introducción AstrBot=3.5.17 tiene un JWT secret hardcodeado en el código fuente, lo que permite subir plugins arbitrariamente y lograr RCE Uso root@kitploit: python main.py 'http://127.0.0.1:6185' Código fuente https://github.com/AstrBotDevs/AstrBot.git...

CVE-2025-8570

CVE-2025-8570 BeyondCart Connector = 2.1.0 - Configuración faltante del secreto JWT para escalada de privilegios no autenticada 🚨 BeyondCart Connector = 2.1.0 - Escalada de privilegios JWT CVE-2025-8570 🛡️ Resumen de la vulnerabilidad El plugin BeyondCart Connector para WordPress, en las versiones...

CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard 预认证路径遍历 本 Lab 复现 Nezha Dashboard 中的 通过/dashboard.. 前缀混淆实现的预认证路径遍历 漏洞， 导致 jwtsecretkey 泄露 - 伪造 JWT - 夺取管理员权限。 Docker 环境，按版本进行 A/B 分离以对比 漏洞版 vs 已修补版 。...

CVE-2026-79575

CVE-2026-79575 affects yfexam-exam v2.0 , where the JWT signing secret is derived from the username and the current month rather than a random server-side key. This weak derivation makes the secret easily recoverable via a bruteforce attack , allowing an unauthenticated network attacker to forge ...

EUVD-2026-72912

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

CVE-2026-85391

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

EUVD-2026-70668

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

CVE-2026-85391

Peppermint through version 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml, also referenced in apps/api/src/lib/jwt.ts. This allows unauthenticated attackers to forge session tokens for arbitrary user IDs and access protected endpoints without valid credentials. The vulnerabil...

CVE-2026-78062

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

CVE-2026-78062

CVE-2026-78062 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability resides in the JWT Secret Handler component, specifically the envSchema.parse function in lib/config.ts. Manipulation of the BETTER_AUTH_SECRET argument results in hard-coded credentials , enabling remote unauthenticat...

EUVD-2026-64631

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

CVE-2026-78062 vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...