SessionHop

SessionHop SessionHop is a C tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's...

PuttyRider

PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected root@kitploit:...

ja4

JA4+™ Network Fingerprinting JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — Meta-Phishing Facebook Graph API — OAuth Token Reuse & Session Hijacking...

CVE-2024-57428

CVE-2024-57428 A stored cross-site scripting XSS vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields eventimg, seatmaps and seat number configurations numbernewX in pjActionCreate. Attackers can inject persistent JavaScript, leading to...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Cross-Site Scripting XSS Almacenado en Clientes Resumen SolidInvoice es vulnerable a un problema de Cross-Site Scripting XSS Almacenado en el Módulo de Clientes. Un atacante autenticado puede inyectar JavaScript arbitrario en la aplicación, el cual se ejecutará en lo...

CVE-2020-25399

CVE-2020-25399 XSS almacenado en InterMind iMind Server hasta 3.13.65 permite a cualquier usuario secuestrar la sesión de otro usuario enviando un archivo malicioso en el chat. Información Descripción: un atacante puede enviar un archivo malicioso a cualquier usuario mediante la funcionalidad de...

TeleShadow2

TeleShadow 2 Teleshadow2- Advanced Telegram Desktop Session Hijacker! Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after compiling. How do I use the session file? Delete everything...

CVE-2024-5420-XSS

Descripción Se encontró una vulnerabilidad en utnserver Pro, utnserver ProMAX e INU-100 en la versión 20.1.22 y anteriores, que afecta al parámetro de descripción del dispositivo en la interfaz web. Esta falla permite un ataque de cross-site scripting almacenado XSS, permitiendo a los atacantes...

NetworkAssessment

NetworkAssessment: Herramienta de Evaluación de Compromiso de Red La Herramienta de Evaluación de Compromiso de Red está diseñada para analizar archivos pcap y detectar tráfico de red potencialmente sospechoso. Esta herramienta se centra en identificar actividades anormales en el tráfico de red y...

CVE-2024-33231

Vulnerabilidad XSS en Ferozo Webmail a través de Subida de Archivos CVE-2024-33231 Descripción La versión 1.1 de Ferozo Webmail es vulnerable a Cross-Site Scripting XSS mediante la funcionalidad de subida de archivos. Un atacante puede explotar esta vulnerabilidad subiendo un archivo especialment...

CVE-2025-61922-PoC

Exploit CVE-2025-61922: Toma de Cuentas en PrestaShop Checkout Un script simple y educativo de prueba de concepto que demuestra la vulnerabilidad de toma de cuentas sin clic en el módulo PrestaShop Checkout CVE-2025-61922. ⚠️ Aviso Legal y Ético: Usar Responsablemente Esta herramienta es solo para...

TeleShadow3

TeleShadow3 Teleshadow3- Advanced Telegram Desktop Session Hijacker! Download Click HERE to download the latest version! Screenshot Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after...

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

MaxSite CMS > V106 - Cross-Site Scripting

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." id: CVE-2021-35265 info: name: MaxSite CMS V106 - Cross-Site Scripting author: pikpikcu severity: medium description: | A reflected...

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI. id: CVE-2021-26475 info: name: EPrints 3.4.2 - Cross-Site Scripting author: geeknik severity: medium description: EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI...

SysAid 20.4.74 - Cross-Site Scripting

SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. id: CVE-2021-31862 info: name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via...

ETQ Reliance - Reflected XSS via SQLConverterServlet

A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...

CandidATS 3.0.0 - Cross-Site Scripting

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...