CVE-2024-51996

⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit 针对关键漏洞 CVE-2024-51996 的 Exploit，可在使用 Remember Me 机制的 Symfony 应用中实现 认证绕过 。 🧠 影响 ：无需有效凭据即可冒充特权用户（如 admin）。 📖 描述 CVE-2024-51996 是 Symfony 组件 security-http 中的一个漏洞。问题在于 未能正确验证REMEMBERME cookie 中所包含的用户名，从而允许在令牌未失效的情况下修改用户名。 拥有有效 cookie（例如...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 漏洞利用工具 CVE-2025-5947 漏洞利用工具 - Service Finder Bookings WordPress Service Finder Bookings ≤ 6.0 插件中身份验证绕过漏洞的利用工具 📋 目录 漏洞介绍 技术细节 安装 使用方法 示例 结果 安全 参考资料 🔴 漏洞介绍 CVE-2025-5947 Service Finder Bookings WordPress 插件 6.0...

SUSE-SU-2026:4404-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

SUSE-SU-2026:4403-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

Camera-Dahua-Research-l-h-ng-CVE-2021-33044

Dahua认证绕过PoC模拟利用 CVE-2021-33044 概述 Dahua IP摄像头是安防监控系统中广泛使用的物联网设备。由于常部署在内网或可从互联网访问，IP摄像头的安全漏洞会严重影响隐私和信息安全。 CVE-2021-33045是存在于某些Dahua摄像头系列中的安全漏洞，允许未经身份验证即可非法访问内部配置资源。该漏洞源于设备固件中访问控制机制不严格。 漏洞信息 项目| 内容 ---|--- CVE| CVE-2021-33044 类型| Authentication Bypass 严重程度| Critical CVSS 9.8 认证| 无需认证 影响范围| Dahua...

CVE-2025-10720-PoC

描述 该概念验证（PoC）描述了在 WordPress 插件 WP Private Content Plus v3.6.2 中发现的一个认证绕过漏洞。该问题允许未认证用户绕过受密码保护的内容，原因在于不恰当地依赖客户端 Cookie。 详情 漏洞类型 ：认证绕过（未认证） CWE-ID ：CWE-565 - 依赖未经验证和完整性检查的 Cookie 影响 成功利用允许未认证用户访问插件全局密码功能保护的内容。 参考 视频演示 WPScan 受影响插件...

Reliance on Cookies without Validation and Integrity Checking

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via getuserfromtoken in keycloakauthmanager.py, where Keycloak...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

SUSE-SU-2026:23489-1 Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023. - CVE-2026-53246: sctp: validate cached peer INIT chunk length i...

CVE-2026-86241

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

EUVD-2026-72190

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86241

liufee FeehiCMS (up to 2.1.1 ) is affected by a hard-coded cryptographic key vulnerability in the Cookie Validation component, specifically in the file environments/prod/backend/config/main-local.php. Manipulation of the cookieValidationKey argument leads to use of a fixed key, allowing remote at...

CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86241: Use of Hard-coded Cryptographic Key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

PT-2026-86593

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2 Description An issue exists in the Cookie Validation component within the file environments/prod/backend/config/main-local.php. The manipulation of the cookieValidationKey argument leads to the use of a...

CVE-2026-86250

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

EUVD-2026-72106

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

CVE-2026-86250 h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...