CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s Fabric Connector component. It impacts FortiWeb versions: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Technical Details The issue resides in the getfabricuserbytoken function...

BIT-TOMCAT-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

CVE-2022-3172

CVE-2022-3172 demo Run poc.sh create resources root@kitploit: chmod +x poc.sh ./poc.sh Use Curl root@kitploit: curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

poc_cve-2026-42208

CVE-2026-42208 — LiteLLM 预认证 SQL 注入 一个用于复现和检测 CVE-2026-42208 的实验室环境，这是 LiteLLM 中的一个严重预认证 SQL 注入漏洞，未经过滤的 Bearer 令牌会直达原始 PostgreSQL 查询。 漏洞概述 字段| 详情 ---|--- CVE ID| CVE-2026-42208 GHSA| GHSA-r75f-5x8p-qvmc CVSS| 9.3（严重）— AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 受影响版本| = 1.81.16, ← payload does NOT start...

CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM 预认证 SQL 注入计时 PoC 本地 Docker 实验环境及针对 CVE-2026-42208 的最小危害 PoC，该漏洞是 LiteLLM Proxy API 密钥验证路径中的预认证 SQL 注入漏洞。 本仓库通过基于计时的 PostgreSQL pgsleep 证明，演示了存在漏洞的 LiteLLM 实例与已修补的 LiteLLM 实例之间的差异。 范围：仅限本地实验环境 / 授权测试。默认 PoC 不会转储数据库数据，也不会修改数据库数据。 概述 CVE-2026-42208 影响 LiteLLM Proxy 1.81.16 至...

CVE-2026-86754

Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...

EUVD-2026-74932

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (/oauth/personal-access-tokens*) with only the web and auth:web middleware, lacking the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any user with a valid we...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-56207

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-56207 Apache Impala: SAML authentication bypass via forged bearer token

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-56207

Apache Impala (>=4.0.0) has a SAML2 authentication bypass in its hs2-http interface. The signature of the Bearer token is not verified in the final step of the SAML2 authentication flow, allowing an attacker to alter the user name and impersonate another user without valid credentials. The vul...

EUVD-2026-74797

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

EUVD-2026-74773

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

CVE-2026-80099 affects several Newfold WordPress plugins (Crazy Domains, Web, Hostgator, Bluehost) that bundle the wp-module-data module. The root cause is an HMAC-style Bearer token validation flaw : when HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to an empty stri...

PT-2026-88906

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the rest authentication errors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-88922

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: =4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

SnaffPoint

SnaffPoint 它是什么 SnaffPoint 是一款为那些需要在这个世界上获得一些甜蜜的渗透测试人员打造的工具。它可以帮助你发现公司（或客户）的 SharePoint Online 和共享 OneDrive 文件中存在的敏感文件。 它是如何工作的 实际上有 2 个工具： GetBearerToken 将为你对 SharePoint 执行身份验证，带有常规 GUI 并支持 MFA SnaffPoint 仅限 CLI，它将自行执行枚举并找出有趣的文件 GetBearerToken 没什么特别的，按如下方式运行该工具： root@kitploit: GetBearerToken.exe...