fortios-auth-bypass-poc-CVE-2024-55591

CVE-2024-55591 A Fortinet FortiOS Authentication Bypass Vulnerable PoC Description Use this poc,you can bypass authentication and see system log USEAGE root@kitploit: sysirq@sysirq-machine:/Work/Fortinet/FortiGate7016/CVE-2024-55591$ python3 poc.py usage: poc.py -h --target TARGET --port PORT...

CVE-2021-38699-Stored-XSS

CVE-2021-38699: XSS almacenado en TastyIgniter v3.0.7 Restaurtant CMS Existe cross-site scripting almacenado y autenticado en la sección System Logs de la aplicación web TastyIgniter v3.0.7 Restaurtant CMS. https://vulners.com/cve/CVE-2021-38699 POC 1. Ejecute cross-site scripting reflejado en ot...

CVE-2026-51735

CVE-2026-51735 is an incorrect access control vulnerability in the showSyslog function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve recent system logs , potentially exposing sensitive networ...

EUVD-2026-68751

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

CVE-2026-79666

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-79669

Ech0 versions before 4.4.3 lack authorization checks on system log endpoints, allowing any authenticated non-admin user to read and stream all server logs. The vulnerable endpoints are GET /api/system/logs , GET /api/system/logs/stream , and WS /ws/system/logs . An attacker can gather reconnaissa...

EUVD-2026-65445

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

EUVD-2026-65448

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-56456

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

OESA-2026-2907 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: A flaw was found in Cockpit. Deleting a sosreport with a crafte...

OPENSUSE-SU-2026:21208-1 Security update for cockpit

This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040...

GO-2026-5701 Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0

Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

The vulnerability of the LibreChat artificial intelligence-based platform lies in its lack of mechanisms for processing input data that is recorded in system logs. This allows attackers to gain access and modify data in the logs.

The vulnerability of the LibreChat artificial intelligence-based platform is related to deficiencies in the mechanism for processing input data that is recorded in system logs. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to modify data in the log files...

Exploit for CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python proof of concept for CVE-20...

CVE-2026-50205

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data...

Updated cockpit packages fix security vulnerabilities

CVE-2026-4631, Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects...

MGASA-2026-0175 Updated cockpit packages fix security vulnerabilities

CVE-2026-4631, Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects...