CVE2_Jenkins_RCE

Jenkins CLI Websocket Hijacking - PoC A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. This exploits targets the Jenkins CLI that can be used to remotely access and issue commands to a Jenkins control server...

aapanel-ws-bypass

aaPanel: Vendors Don't Always Fix Things Properly An incomplete fix for CVE-2021-37840 still exposes 3.6M servers to root RCE, 5 years later Discovered by: EON Security CVE: Pending assignment CVSS: 8.8 High — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: aaPanel versions 6.8.12 through 7.65.0...

CVE-2020-14368

CSWSH-THEIA-CVE-2020-14368 Report target: Eclipse CHE deployment available on che.openshift.io Vulnerability type: Cross-site websocket hijack Discovery date: 2020-04-08 Author: Robin Duda codingchili@github Summary The /services websocket endpoint in Eclipse CHE adn Theia is vulnerable to...

CVE-2025-1094-Exploit

CVE-2025-1094: SQL Injection to RCE via WebSocket 🚀 This repository contains a proof of concept PoC exploit for CVE-2025-1094 , a vulnerability in PostgreSQL that allows an SQL Injection SQLi attack to escalate to Remote Code Execution RCE through WebSocket hijacking. Overview This exploit...

CVE-2025-68930

🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking CSWSH vulnerability in Traccar , the open-source GPS tracking system. Below are the key details: 🛡️ Vulnerability Details Affected endpoint : /api/socket...

agentbox

🛡️ AgentBox 面向 AI 代理的开源沙箱运行时 放心运行 AI 代理。每个代理都拥有自己的权限范围、凭据保险库、审计追踪和紧急终止开关。 AgentBox 存在的原因 2026 年 1 月 27 日，CVE-2026-25253 成为首个被分配给智能体 AI 系统的 CVE。OpenClaw 中的一个严重 WebSocket 劫持漏洞使得攻击者能够对任何暴露的实例（包括仅绑定到 localhost 的实例）进行一键远程代码执行。 同一周，ClawHavoc 活动 将 341+ 个恶意技能渗透进了 OpenClaw 的市场。从 ClawHub 安装的每个技能都以与 OpenClaw...

openclaw-vuln-report

OpenClaw 漏洞分析报告 CVE-2026-25253 安全漏洞中文解读 在线阅读 GitHub Pages: https://joseph19820124.github.io/openclaw-vuln-report/ 漏洞摘要 CVE : CVE-2026-25253 评分 : CVSS 8.8 高危 类型 : 跨站 WebSocket 劫持 影响 : 一键点击实现远程代码执行 来源 原文: The Hacker News...

CVE-2026-25253-research

CVE-2026-25253 概念验证 通过跨站 WebSocket 劫持在 OpenClaw 上实现一键远程代码执行（RCE）。 免责声明： 此代码仅供授权的安全研究和教育目的使用。在未经明确书面许可的情况下，将此代码用于针对任何系统属于违法行为且不道德。作者对滥用行为不承担任何责任。 博客 阅读详细分析，了解该漏洞的源码级剖析以及此 PoC 的构建过程。 前提条件 Node.js（v18 或更高版本） 在受害者机器上运行着启用了 Gateway 的 OpenClaw 实例（默认：localhost:18789） 受害者的浏览器中必须存储有有效的认证令牌（即他们之前使用过 Contro...

CVE-2026-71416

Headroom is a WebSocket proxy that compresses data before it reaches a large language model. Prior to version 0.35.0 , its WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows a Cross-Site WebSocket H...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-85183

Taipy (a Python web application framework) through version 4.1.1 misconfigures its socket.io server with a wildcard CORS origin and the credential flag enabled. This allows any web page to establish credentialed WebSocket connections to a victim's Taipy application, enabling attackers to open soc...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74802 SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74802

SiYuan versions before 3.7.4 set the WebSocket CheckOrigin handler to unconditionally return true on the admin-only /ws/network/proxy endpoint, allowing cross-site WebSocket hijacking. A malicious webpage can make the victim's SiYuan kernel proxy arbitrary network traffic, enabling authenticated ...

EUVD-2026-60085

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-66420 MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-66420

MeshCentral 1.1.21 is affected by a cross-site WebSocket hijacking vulnerability caused by an unconditional early return in CheckWebServerOriginName() in webserver.js when using self-signed certificates. This allows unauthenticated remote attackers to initiate cross-origin WebSocket connections t...