CVE-2026-77130

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

EUVD-2026-65345

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

EUVD-2026-65344

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

CVE-2026-77131

CVE-2026-77131 affects the TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy). When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it, resulting in a cleartext transmission of sensitive data. Exploitation r...

CVE-2026-77139 Path Traversal in extension "Mask" (mask)

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

EUVD-2026-65337

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2025-65945-poc

CVE-2025-65945: Bypass della firma in node-jws Questa è una proof of concept per un bypass della verifica della firma nella libreria node-jws. Il bug consente agli attacker di forgiare JWT validi quando il server deriva i segreti HMAC da dati controllati dall'utente. Qual è il bug? La funzione...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.30 security and extras update

Red Hat OpenShift Container Platform release 4.21.30 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Grafxploit

Strumento di exploit automatizzato per Grafana CVE-2021-43798 Panoramica Questo progetto è uno strumento di exploit automatizzato progettato per scansionare ed estrarre informazioni sensibili da istanze Grafana compromesse vulnerabili a CVE-2021-43798. Lo strumento identifica i plugin vulnerabili...

CVE-2024-3408-dtale

CVE-2024-3408 - Bypass dell'autenticazione e RCE in D-Tale Ambiente di laboratorio riproducibile per CVE-2024-3408, una vulnerabilità di bypass dell'autenticazione ed esecuzione remota di codice in D-Tale. Vulnerabilità Le versioni di D-Tale fino alla 3.15.1 sono vulnerabili a causa di: 1...

CVE-2020-11651-PoC

CVE-2020-11651-PoC Repository che contiene un exploit CVE-2020-11651 aggiornato per funzionare con le ultime versioni di Python e gestire gli errori relativi alle connessioni. COPIA DEL README DAL REPOSITORY ORIGINALE Repository Originale Exploit PoC per CVE-2020-11651 e CVE-2020-11652 Questo è u...

CVE-2025-63353

CVE-2025-63353 Una vulnerabilità in fiberhome GPON ONU HG6145F1 RP4423 consente di prevedere la password Wi-Fi predefinita di fabbrica del dispositivo chiave pre-condivisa WPA/WPA2 dall'SSID...

buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...

immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Demo di cybersecurity come prova di concetto per CVE-2026-35455, che mostra la generazione automatica di chiavi API e l'esfiltrazione di dati, portando al completo dirottamento dell'account e all'accesso non autorizzato persistente. Scopri di...

CVE-2026-29000-PoC

CVE-2026-29000 — Prova de Conceito de Bypass de Autenticação do JwtAuthenticator do pac4j-jwt Uma prova de conceito para CVE-2026-29000 , um bypass de autenticação no componente pac4j-jwt JwtAuthenticator CVSS 10.0 , Crítico. O script forja um token que se passa por qualquer usuário com qualquer...

CVE-2020-10560-Key-Recovery

CVE-2020-10560 Recupero della chiave AES Questa PoC recupera la sitekey per OSSN 5.3 e versioni successive. Per maggiori informazioni vedere http://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...