CVE-2025-32432

CraftCMS CVE-2025-32432 भेद्यता शोषण उपकरण सेट SensePost अनुसंधान पर आधारित CraftCMS रिमोट कोड निष्पादन भेद्यता शोषण उपकरण। 📁 फ़ाइल विवरण 🎯 मुख्य उपकरण 1. finalpoc.py - अंतिम अनुकूलित POC सूचना रिसाव और रिमोट कोड निष्पादन का समर्थन करता है स्वचालित एसेट आईडी खोज कई सत्र इंजेक्शन विधियाँ विस्तृत...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM प्रमाणीकरण बाईपास एकल और बहु-लक्ष्य अस्वीकरण: यह दस्तावेज़ और संबद्ध स्क्रिप्ट exploit.py केवल शैक्षिक उद्देश्यों, सुरक्षा अनुसंधान और अधिकृत पैठ परीक्षण के लिए प्रदान किए गए हैं। इस सॉफ़्टवेयर का उपयोग उन सिस्टमों के विरुद्ध न करें जिनके आप स्वामी नहीं हैं या जिनके...

cPanel-WHM-AuthBypass-Session-Checker

أداة التحقق من الجلسة CVE-2026-41940 أداة مساعدة لاستغلال تجاوز المصادقة CVE-2026-41940 الخاص بـ watchTowr. بعد تشغيل الاستغلال الرئيسي ضد هدف cPanel/WHM، يتحقق هذا السكربت من ما إذا كانت الجلسة المحقونة تمنح فعلاً وصولاً مصادقاً عبر اختبار نقاط نهاية متعددة صفحات HTML، واجهة برمجة تطبيقات JSON،...

challack

CVE-2016-5696 के लिए प्रूफ-ऑफ-कॉन्सेप्ट कोड यह कोड वर्तमान में कनेक्शन रीसेट करने या सत्रों में इंजेक्शन लगाने की अनुमति देता है। हमला क्लाइंट और सर्वर दोनों के खिलाफ लागू किया गया है। विस्तृत जानकारी के लिए, मूल प्रकाशन देखें: ऑफ-पाथ TCP शोषण: वैश्विक दर सीमा खतरनाक मानी गई आवश्यकताएँ 1. आपको...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - أداة استغلال تجاوز المصادقة في cPanel وWHM تجاوز مصادقة حرج عبر حقن CRLF في خدمة cpsrvd الخاصة بـ cPanel/WHM 📋 نظرة عامة CVE-2026-41940 عبارة عن ثغرة تجاوز مصادقة حرجة في cPanel وWHM تتيح للمهاجمين عن بُعد دون مصادقة الحصول على وصول إداري كامل بصلاحيات الجذر إلى الخادم. تكمن الثغ...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== PHP संस्करण 7.1.x जो 7.1.33 से नीचे हैं, 7.2.x जो 7.2.24 से नीचे हैं, और 7.3.x जो 7.3.11 से नीचे हैं PHP 7.2.20/7.3.10 के तहत परीक्षण किया गया निर्देश 1、अपेक्षाकृत स्थिर, बस query लंबाई और हेडर फ़ील्ड लंबाई को ब्रूट-फोर्स करें 2、autosessi...

Siemens Teamcenter

SUMMARY A reflected cross site scripting vulnerability in the authentication redirect flow /auth/ of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

The Datadog Android application versions prior to v541-5.9.2 are vulnerable to an account-confusion issue. The exported launcher activity, AppActivity , accepts an attacker-supplied session (including OAuth tokens ) via Intent extras without a permission guard. Because the app fails to validate t...

PT-2026-69091

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 5.9.2 Description The launcher activity AppActivity is declared as exported with launchMode="singleTask" and lacks a permission guard. The application invokes Intent.getUserSession during onCreate...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager: established connections are resolved by a two-byte local connection handle without verifying the datagram source against the registered remote address. An on-path attacker observi...

PYSEC-2026-3600 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

CVE-2026-54364

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

CVE-2026-54364 CentreStack < 17.4 Session Injection via SelectProvider.aspx

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

EUVD-2026-51100

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

CVE-2026-54364

CentreStack

CVE-2026-54364 CentreStack < 17.4 Session Injection via SelectProvider.aspx

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

PT-2026-66465

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...