176 matches found
CVE-2023-27524-POC
CVE-2023-27524: Apache Superset Auth Bypass Script to check if an Apache Superset server is vulnerable to CVE-2023-27524 and if it is vulnerable then, forge a session cookie with the userid = 1 which is usually the admin user allowing for authentication bypass and gaining access to the dashboard...
Gogs_RCE
GogsRCE Vulnerability Reproduction 0x01 Register a Regular Account on the Frontend 0x02 Compile a Forged Admin Session Using Go go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj...
CVE-2026-19490
CVE-2026-19490 — NetScaler ADC/Gateway SAML authentication bypass Unauthenticated session forgery on Citrix NetScaler ADC / NetScaler Gateway via the SAML HTTP-Redirect binding handler at GET /cgi/samlauth. CVSS 4.0 9.3, CWE-288. Bulletin CTX696939 2026-08-19, no workarounds. Credit for the...
cpanel-sessionscribe
SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...
SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit
= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...
CVE-2026-41940
CVE-2026-41940 – cPanel/WHM Auth Bypass + Root Password Changer This script exploits an authentication bypass vulnerability in cPanel/WHM CVE-2026-41940 using a CRLF injection technique to forge an administrator session. Once successful, the script can change the root user's password in WHM and...
CVE-2026-61500
CVE-2026-61500: Rejetto HFS session forgery to RCE CVE-2026-61500 is an unauthenticated session-forgery vulnerability in Rejetto HFS 3.0.0 through 3.2.0. HFS generated its Koa session-cookie signing key with JavaScript Math.random and exposed outputs from the same V8 PRNG in the unauthenticated S...
GHSA-3XF4-9G3C-4H4W Nuxt dev server exposes generated appSecret through Vite file serving
Impact When no appSecret is configured via NUXTAPPSECRET, NITROAPPSECRET or runtimeConfig.appSecret, nuxt dev generates a development secret and stores it in /app-secret by default .nuxt/app-secret. The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the...
Nuxt dev server exposes generated appSecret through Vite file serving
Impact When no appSecret is configured via NUXTAPPSECRET, NITROAPPSECRET or runtimeConfig.appSecret, nuxt dev generates a development secret and stores it in /app-secret by default .nuxt/app-secret. The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the...
CVE-2026-119660
MuseBot versions prior to 2.0.0 are vulnerable to an authentication bypass caused by a hard-coded default session_key (muse_bot_session_key). This flaw allows unauthenticated attackers to forge valid MuseBot-session cookies by signing them with the known key and a specific user_id. Successful exp...
CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access,...
CVE-2026-119201
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in /app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server c...
PT-2026-121745
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
BIT-NGINX-GATEWAY-2026-97629 NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
Astra Linux – vulnerability in Zabbix
A bug in the code allows an attacker to sign a forged zbxsession cookie, which then enables them to log in with administrative privileges...
UBUNTU-CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-97629 NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
Session forgery when using TLS session tickets
Session forgery when using TLS session tickets Severity: medium CVE-2026-97629 Not vulnerable: 1.31.7+, 1.30.6+ Vulnerable: 1.23.2-1.31.6...
Apache Superset 2.0.1 Session Forgery
Apache Superset version 2.0.1 using a known default SECRETKEY allows session-cookie forgery and authentication as another user. This proof of concept verifies default keys, forges a selected user session, and can validate it. https://packetstorm.news/download/234971...
