XSSight

ADVERTENCIA: Esta página es solo para educación; cualquier propósito malicioso por parte de los usuarios que la utilicen será castigado conforme a la ley. XSSight Cross-site Scripting XSS Cross-site Scripting XSS es una técnica de ataque que implica reflejar código proporcionado por el atacante e...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Secuestro de cuenta privilegiada Fecha: 30-03-2019 Autor del exploit: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Página del vendor:www.manageengine.com Producto: Service Desk Plus Versión: 10.0 Probado en: Windows 10 64 bits CVE : 2019-100...

CVE-2025-51863

CVE-2025-51863 漏洞描述 ChatGPTUtil 是一款基于 AI 的聊天机器人助手，提供对 ChatGPT 和 AI 图像生成器的访问。聊天组件中存在一个自跨站脚本（Self-XSS）漏洞。该漏洞可能导致 cookie 被窃取，进而实现远程账户劫持。 攻击向量 攻击向量为网络。要利用此 XSS 漏洞，攻击者必须构造恶意载荷（例如 SVG XSS 载荷），并将其传递给受害者（例如通过电子邮件、恶意网站、论坛帖子或即时消息）。当受害者将载荷粘贴到 ChatGPTUtil 聊天界面时，攻击就会发生。POC 如下： root@kitploit:...

CVE-2023-22894

Exploit no autenticado de Strapi: CVE-2023-22894 Este repositorio contiene una prueba de concepto PoC del exploit para CVE-2023-22894, que permite a usuarios no autenticados filtrar información sensible y secuestrar cuentas de administrador de Strapi explotando la funcionalidad de filtrado de...

immich-exfiltration-demo

Demo de ciberseguridad: exfiltración de Immich CVE-2026-35455 Prueba de concepto de ciberseguridad para CVE-2026-35455, que demuestra la generación automatizada de claves de API y la exfiltración de datos que conduce al secuestro total de la cuenta y al acceso no autorizado persistente. Más...

CVE-2025-3604

🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Crítico Publicado : 23 de abril de 2025 Última actualización : 24 de abril de 2025 ⚙️ Ejemplo de salida del script root@kitploit: Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to:...

CVE-2026-71403 Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next log...

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. Thes...

CVE-2026-48911

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

EUVD-2026-51841

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

VulnCheck KEV: CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...

CVE-2026-48117

DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed accoun...

CVE-2026-48117 DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover

DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed accoun...

CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...

CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...

CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...