Gogs_RCE

GogsRCE 취약점 재현 0x01 프론트엔드에서 일반 계정 등록 0x02 go 컴파일로 관리자 세션 위조 go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj gob.Registerv buf := bytes.NewBuffernil err := gob.NewEncoderbuf.Encodeob...

cpanel-sessionscribe

SessionScribe - CVE-2026-41940 cPanel 및 WHM의 중요 인증되지 않은 원격 코드 실행RCE 취약점. 네 번의 HTTP 요청으로 CRLF 주입을 통해 사전 인증 세션의 비밀번호 필드에 삽입하여 루트 세션을 위조합니다. 인증 불필요, 사전 조건 없음, 지원되는 모든 티어에 영향을 미칩니다. 2026년 4월 28일 Sina Kheirkhah / watchTowr Labs가 공개. Quickstart · ioc-scan · mitigate · remote-probe · Affected builds ·...

CVE-2026-19490

CVE-2026-19490 — NetScaler ADC/Gateway SAML認証バイパス Citrix NetScaler ADC / NetScaler Gatewayにおける、GET /cgi/samlauth のSAML HTTP-Redirectバインディングハンドラを介した未認証セッション偽造。CVSS 4.0 9.3、CWE-288。 セキュリティ情報CTX696939（2026-08-19）、回避策なし。元の報告の功績はSamarth Vashisht（JPMorgan...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM 인증 우회 + 루트 비밀번호 변경기 이 스크립트는 CRLF 인젝션 기술을 사용하여 관리자 세션을 위조함으로써 cPanel/WHMCVE-2026-41940의 인증 우회 취약점을 악용합니다. 성공하면 스크립트는 WHM에서 root 사용자의 비밀번호를 변경하고 Telegram을 통해 알림을 보낼 수 있습니다. 경고: 소유한 시스템 또는 서면 허가를 받은 시스템에서만 보안 테스트 용도로 사용하십시오. 이 스크립트를 불법 액세스에 악용하는 것은 법률 위반입니다. 📦 의존성 설치 PIP ...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE 전체 체인 익스플로잇 1. 경영진 요약 및 개요 본 문서는 내부적으로 Ni8mare로 지정된 CVE-2026-21858 취약점에 대한 결정적 기술 재구성 분석을 제시합니다. 이 취약점은 CVSS 10.0치명적 점수를 가지며 n8n 자동화 플랫폼의 Form Webhook 노드에서 식별되었습니다. 이 결함은...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641

The open-source project management tool Plane contains hardcoded credentials in its community deployment manifests prior to version 1.4.0 . Specifically, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known defaults for SECRET_KEY and LIVE_SERVER_S...

Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

A critical security flaw impacting Rejetto HTTP File Server HFS is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 CVSS score: 9.3, a case of session forgery stemming from the use of a weak pseudo-random number generator PRNG that c...

CVE-2026-61500

CVE-2026-61500: Rejetto HFS のセッション偽造から RCE へ CVE-2026-61500 は、Rejetto HFS 3.0.0 から 3.2.0 にかけて存在する未認証のセッション偽造脆弱性です。HFS は Koa のセッション Cookie 署名鍵を JavaScript の Math.random で生成し、さらに未認証の SRP ログインハンドシェイクにおいて同一の V8 PRNG の出力を露出していました。攻撃者は PRNG の状態を再構築し、署名鍵を復元し、管理者セッションを偽造し、文書化されている servercode...

CVE-2023-27524-POC

CVE-2023-27524: Apache Superset 인증 우회 Apache Superset 서버가 CVE-2023-27524에 취약한지 확인하고, 취약하다면 userid = 1 일반적으로 admin 사용자로 세션 쿠키를 위조하여 인증을 우회하고 대시보드에 접근할 수 있는 스크립트입니다. 현재 전 세계적으로 약 3000대의 서버가 Apache Superset을 실행 중입니다. 사용법 usage: python3 CVE-2023-27524.py --url URL 기본 예제 % python3 CVE-2023-27524.py...

Exploit for CVE-2026-61500

CVE-2026-61500: Rejetto HFS session forgery to RCE !Real ter...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

Cisco Secure Firewall Management Center Software Vulnerabilities

Multiple vulnerabilities in Cisco Secure Firewall Management Center FMC Software could allow a remote attacker to gain root access and perform session forgery or session impersonation. For more information about these vulnerabilities, see the Details "details" section of this advisory. Cisco has...

PT-2026-94035

Name of the Vulnerable Software and Affected Versions SafeLine versions prior to 9.4.2 Description The management console session-signing secret is derived from a time-seeded math/rand generator. This allows unauthenticated remote attackers who can determine the installation timestamp to...

CVE-2026-92749: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-46696

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...