CVE-2024-10508

Escalada de privilegios no autenticada a través de la recuperación de contraseña en RegistrationMagic = 6.0.2.6 Aviso legal : Esta información se proporciona únicamente con fines educativos. Este documento pretende concienciar sobre las vulnerabilidades de seguridad y no debe utilizarse para...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

Flowise-CVE-2025-58434-Chain-59528

FlowiseAI CVE Chain - ATO CVE-2025-58434 and RCE CVE-2025-59528 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents This repository contains a Python proof-of-concept for chainin...

CVE-2025-50433

CVE-2025-50433 — Critical Account Takeover Vulnerability Affecting Monnit Cloud Platforms .imonnit.com Summary A critical authentication vulnerability exists across .imonnit.com that allows full Account Takeover ATO on any user account without victim interaction. The backend fails to validate the...

CVE-2024-34327

CVE-2024-34327 SQL Injection Vulnerability Checker This script V-24-02-001SQLiCheck.py is a proof-of-concept PoC tool to verify the presence of a time-based blind SQL injection vulnerability affecting the password-reset-token.php endpoint, identified as CVE-2024-34327. ⚠️ Disclaimer This tool is...

HTB-Silentium-Writeup

HTB - Writeup de Silentium Información de la Máquina Nombre: Silentium SO: Linux Dificultad: Fácil CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeración Escaneo con Nmap nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Puertos abiertos: 22 SSH, 80 HTTP Hosts virtualesstaging.silentium.htb...

CVE-2025-63314

CVE-2025-63314 - Manejo inadecuado del token de restablecimiento de contraseña en Acora CMS Descubierto por Joby Y Daniel de Crowe India 📌 Resumen DDSN Interactive cm3 Acora CMS versión 10.7.1 contiene una vulnerabilidad de seguridad en su funcionalidad de restablecimiento de contraseña. La...

CVE-2022-24181

CVE-2022-24181 和 CVE-2022-26616。两者可能相同 Open-journal-system-漏洞 通过主机头注入的XSS及窃取其他用户的密码重置令牌 复现步骤： 1. 访问此网站：https://who's-using-ojs-software.com 2. 在Burp中捕获此请求，并发送到Repeater。 3. 在Host Header之后添加此内容：X-Forwarded-Host: foo"x=".com 4. 然后点击发送，之后右键点击请求并选择在浏览器中显示响应，然后复制该请求。 5. 在浏览器中粘贴此请求，你会看到XSS弹窗。...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

CVE-2026-18550

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

EUVD-2026-69021

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

PT-2026-84146

Name of the Vulnerable Software and Affected Versions Nokri - Job Board WordPress Theme versions prior to 1.6.7 Description Insufficient reset token validation in the nokri reset password function allows unauthenticated attackers to perform privilege escalation via account takeover. By providing ...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923: Use of a Key Past its Expiration Date

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...