CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

CVE-2026-115933

The Postiz application is vulnerable to a critical flaw where it signs session, invitation, and password reset tokens using a single shared secret without specifying the token's purpose. A specific route refreshing browser-extension channel credentials allows users to submit signed data from a re...

CVE-2021-40903

Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass CVE: CVE-2021-40903 Date: 09/06/2021 Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Exploit Author: CQR.company / Vulnz. Vendor Homepage: https://github.com/anselal/antminer-monitor,...

netview

= netview Netview is a enumeration tool. It uses with the -d the current domain or a specified domain with the -d domain to enumerate hosts. You can also use the -f if you wish to specify a file with a list of hosts instead. Any hostnames you wish to exclude can be specified in a list with -e. If...

CVE-2026-41940

CVE-2026-41940 - WHM/cPanel Authentication Bypass Mass Exploit 📋 Description CVE-2026-41940 is a critical authentication bypass vulnerability in WHM/cPanel that allows attackers to bypass authentication and gain root access to a server without valid credentials. The vulnerability leverages CRLF...

CVE-2024-11318

CVE-2024-11318 IDOR - AbsysNet 2.3.1 User Hijacking DISCLAIMER This tool is designed to help identify and exploit whether an application is vulnerable to this specific CVE-2024-11318. It is intended for use by cybersecurity professionals, researchers, and penetration testers to assess security in...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin Cross-Organization Resource Authentication Bypass Proof-of-concept for CVE-2026-72001 , a broken-object-level-authorization flaw in Pangolin 1.22.0 that lets the holder of one resource share link mint a valid resource session for any other resource on the instance...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy before 4.28.030418 Community Edition allows Stored Cross Site Scripting. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2025-4162029

Security Advisory: CVE-2025-4162029 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

cve-2018-11714_POC

cve-2018-11714POC An issue was discovered on TP-Link TL-WR840N. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. artigo pt-br:...

CVE-2026-67279

MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...

Metamorph

Metamorph Introduction This tool is a command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows ETW AutoLogger sessions. AutoLoggers automatically start tracing specific ETW providers upon system boot, making them useful for capturing events th...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat Partial PUT + Deserialization RCE 📋 Overview CVE-2025-24813 is a high‑severity vulnerability in Apache Tomcat that allows unauthenticated remote code execution when three conditions are met: 1. The default servlet has write access enabled readonly=false. 2. Partial...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2025-24813-Apache-Tomcat-RCE-PoC

CVE-2025-24813 Apache Tomcat RCE PoC Description This is a Proof of Concept PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability arises from unsafe deserialization of crafted session files uploaded via HTTP PUT requests, allowing attackers to execu...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Summary Tenda AC15 firmware V15.03.05.18multi issues an authentication cookie in the form password= and returns it without HttpOnly, Secure, or SameSite flags, exposing the password hash to the client. The low-entropy suffix acts as a predictable session identifier,...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS cd vps/pocCVE0264 docker compose up -d...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...

CVE-2025-61686_docker

CVE-2025-61686docker Start 1. Build docker-compose up --build 2. Start docker-compose up Reproduction Steps 1. Construct a session that meets the path traversal condition └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '=' IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg 2. Put the...

CVE-2024-40111-Exploit

CVE-2024-40111: Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Exploit Details Exploit Title : Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Date : 2024-06-20 Exploit Author : Jerry Thomas w3bn00b3r Vendor Homepage : Automad Software Link : Automad GitHub Repository Category ...