gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...

CVE-2022-1175

CVE-2022-1175 GitLab 存储型 XSS，可以在项目（无论是你自己的还是其他用户的）的 issue 中设置。可发起攻击，例如创建并窃取任何访问该 issue 用户的个人访问令牌（PAT）。获取 PAT 后，即可获得该用户完整的 GitLab API 访问权限，等同于完全接管账户。 可以通过将项目的 base 更改为你的站点来滥用此漏洞，从而使脚本从你的站点加载。更改你站点上的 JavaScript，使其与页面中调用的脚本名称匹配。不过这可能会破坏页面上的某些功能。 根据站点的 CSP 策略，标准脚本引入方式也可以生效。这种方式更加隐蔽。 GitLab...

EUVD-2026-89456

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2026-54160

A flaw was found in Network UPS Tools NUT. The project's automated workflow improperly runs untrusted code submitted in pull requests within an environment that holds elevated write privileges. A remote attacker can exploit this flaw by submitting a malicious pull request to achieve arbitrary cod...

cve-2024-55591-poc

CVE-2024-55591 - Fortinet FortiOS 身份验证绕过 一个用 Go 编写的教育性实现，用于演示 CVE-2024-55591 的技术机制，这是一个影响 Fortinet FortiOS 的身份验证绕过漏洞。本仓库严格用于安全研究、防御分析和授权渗透测试。 工作原理 该工具围绕两个主要阶段（目标验证与利用）构建，与漏洞工作流程相对应： 阶段 1：目标验证与检测 1. 管理接口探测： 向 /login?redir=/ng 发送 HTTP/HTTPS GET 请求，并检查响应体中是否存在 FortiOS...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

CVE-2026-101878

Bitwarden Server versions 2025.6.0 before 2026.5.0 are vulnerable to an authentication bypass on SQL Server deployments. The root cause is an identifier truncation issue where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50),...

gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 スコープバイパス（HTTP Basic 認証経由） read:user のみにスコープされた Gitea OAuth2 アクセストークンが、Bearer トークンとしてではなく Authorization: Basic base64:x-oauth-basic として送信されると、完全な書き込みアクションを実行できます。Basic 認証で提示されたトークンはスコープチェックがスキップされます。 影響を受けるバージョン: HTTP 403 blocked Basic PATCH /api/v1/user/settings - HTT...

CVE-2026-101062

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-101062: Incorrect Authorization

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-84884

IBM Guardium Data Protection 12.2 is affected by a vulnerability where internal REST service-account passwords are stored in a reversible plaintext-equivalent format . An authenticated attacker who successfully gains access to these stored credentials can recover the original password to obtain a...

CVE-2026-63493

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

CVE-2026-63203

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203

In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63493: Authentication Bypass Using an Alternate Path or Channel

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...