2839 matches found
invoker
Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...
gcat
Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...
CVE-2026-103869
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...
Keycloak 26.7.3 <= 26.8.0 User Session Note Mapper Access Token Exposure (CVE-2026-105302)
The version of Keycloak installed on the remote host is 26.7.3 through 26.8.0. It is, therefore, affected by a vulnerability where a User Session Note protocol mapper can expose upstream identity provider access tokens to managed clients, allowing a client to obtain a token it was not intended to...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
EUVD-2026-94061
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2022-1175
CVE-2022-1175 Gitlab Stored XSS, can be set in an issue on a project, either your own or another users. Allows attacks such as creating & stealing a Personal Access Token PAT of anyone who visits an issue. PAT's can then provide full Gitlab API access as that user equivilent to a full account...
CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...
BIT-GRAFANA-2026-81841 Paused shared dashboard access tokens still expose data source configuration
Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...
cve-2024-55591-poc
CVE-2024-55591 - Fortinet FortiOS Authentication Bypass An educational implementation in Go demonstrating the technical mechanics of CVE-2024-55591 , an authentication bypass vulnerability affecting Fortinet FortiOS. This repository is intended strictly for security research, defensive analysis,...
CVE-2026-73312
CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...
CVE-2026-105835: Improper Restriction of Excessive Authentication Attempts
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...
PT-2026-107291
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OAuth2 token endpoint fails to verify if a token submitted with the refresh token grant type is actually a refresh token. This allows an unexpired access token for the same OAuth2 applicati...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later , the GET /api/scm/resolve and POST /api/factory/resolver endpoints are vulnerable to Server-Side Request Forgery (SSRF) . The application passes attacker-controlled URLs to URLFetcher.fetch() without an allow-list for schemes or hosts. Consequently, an au...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...