CVE-2021-27513-CVE-2021-27514

exploit-eyesofnetwork Version 5.3.5 up to 5.3.10 CVE-2021-27513 / CVE-2021-27514 The brute-forcing can take a very long time on non production environement cause "sessionid" is created at every login but every sessionid generated by the app are valide for the PoC i deployed an EyesOfNetwork...

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject JWT sub claim specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

CVE-2014-3466_PoC

Proof of Concept for CVE-2014-3466 GnuTLS buffer overflow: session id length check Information See: https://bugzilla.redhat.com/showbug.cgi?id=1101932 This is not a weaponized exploit. be warned: this python code is ugly, I pretty much handcrafted the ServerHello and spent only about five fifteen...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 MatrixSSL session resume bug 1. Description of bug An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. 2. Affected version MatrixSSL...

GHSA-V3PH-CGQH-R8P5 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

EUVD-2026-97830

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validates the session ID and tree ID in compound requests. The function smb2getmsg in smb2getksmbdtcon and smb2checkusersession always returns the first command in a compound request’s headers. If SMB2TREECONNECTHE is the...

CVE-2020-10199_POC-EXP

Affected versions + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version...

CVE-2026-96614

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-96614

The "ゲオアプリ" application, provided by GEO CORPORATION , is vulnerable to improper authorization within its handler for a custom URL scheme . This flaw allows an attacker to force the application's in-app browser to navigate to an arbitrary website. Such actions could potentially lead to phishing a...

CVE-2026-96614

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-96614

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

EUVD-2026-101935

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-96614: Improper Authorization in Handler for Custom URL Scheme

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-82416

FrankenPHP versions prior to 1.12.5 are vulnerable to a cross-request PHP session ID leak in worker mode. The root cause occurs when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time, causing frankenphp_reset_session_state() to be omitt...

CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration,...

CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...