CVE-2024-26144-test

CVE-2024-26144-test Requisito: Docker Compose Deno $ deno run --allow-run --allow-net check.ts Si quieres probar CDN, por favor establece la URL en el argumento. ¡Asegúrate de purgar todas las cachés antes de ejecutar! $ deno run --allow-run --allow-net check.ts https://example.com/ Resultados Si...

CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

fortinet-cve-2024-50562

Vulnerabilidad de Reutilización de Sesión SSL-VPN de Fortinet CVE-2024-50562 Escáner profesional, solo con permiso que comprueba si un FortiGate invalida las cookies de sesión después del cierre de sesión. Un hallazgo positivo confirma CVE-2024-50562 — una falla de Expiración de Sesión Insuficien...

CVE-2023-43804

CVE-2023-43804: urllib3 Cookie Leak Reproduction & Remediation Lab The repository includes a fully containerized, three-tier lab environment which is intended for demonstrating, taking advantage of, and verifying the fixes for CVE-2023-43804 the urllib3 Cookie Leak occurring during cross-origin...

CVE-2022-24706-CouchDB-Exploit

Apache CouchDB 3.2.1 - Ejecución Remota de Código RCE CVE-2022-24706 Fecha: 2022-01-21 Autor del Exploit: Konstantin Burov, @sadshade Enlace del Software: https://couchdb.apache.org/ Versión: 3.2.1 y anteriores Probado en: Kali 2021.2 Basado en Erlang Cookie - Ejecución Remota de Código de 1F98D...

CVE-2024-40512

CVE-2024-40512 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMReporting.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMReporting.asmx function. Vulnerable Product...

CVE-2021-26690---Apache-mod_session

Patch diffing for CVE-2021-26690 - Apache modsession This vulnerability is a NULL pointer dereference within the modsession Apache's module. It will cause a denial of service for the child processes of Apache's httpd. By using a repetitive loop, each Apache workers will crash, leading to a denial...

CVE-2025-24893-EXP

CVE-2025-24893-EXP Versiones Afectadas xwiki-platform = 5.3-milestone-2, = 16.0.0-rc-1, 16.4.1 16.0.0-rc-1, 16.4.1 POC https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24893.yaml CVE-2025-24893 - Exploit de XWiki Platform usage: python CVE-2025-24893.py -u -c...

CVE-2023-45542

CVE-2023-45542 A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: q Exploit - Proof of Concept POC Reflect...

Cookie-Swapper

Cookie Swapper Extensión de Burp Suite que reemplaza automáticamente cookies y encabezados en las solicitudes. Deja de perder tiempo copiando y pegando tokens de sesión en cada solicitud. ¿Por qué? Tienes una repetición de prueba, un error que necesita más información, o simplemente sesiones...

CVE-2024-52475

CVE-2024-52475 WordPress Wawp Plugin = 3.0.17 is vulnerable to Broken Authentication Account takeover Disclaimer! The information provided in this document regarding for CVE-2024-52475 is for learning and educational purposes only. We do not encourage or authorize the use of this information for...

CVE-2025-49132-PoC

Guide to use script that exploit the Pterodactyl Path Traversal at locale.json Requirements Exposed Redis Server Panel URL Guide 1. Get access to the server configuration file, which has APPKEY and Redis Database Password + IP 2. Use forgecookie to generate a pterodactylsession cookie 3. Use that...

MIPS-CVE-2014-9222

Descargo de responsabilidad Los tutoriales son solo para fines informativos y educativos. Creo que el hacking ético, la seguridad de la información y la ciberseguridad deberían ser temas familiares para cualquier persona que utilice información digital y ordenadores. Creo que es imposible...

Vehicle-Service-Management-System-Multiple-Cookie-Stealing-Leads-to-Full-Account-Takeover

CVE-2021-46067 Título del Exploit: Sistema de Gestión de Servicio de Vehículos - 'Múltiple' Robo de Cookies Conduce a la Toma Completa de la Cuenta Autor del Exploit: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRÍTICO Referencias:...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Resumen El firmware Tenda AC15 V15.03.05.18multi emite una cookie de autenticación en la forma password= y la devuelve sin los indicadores HttpOnly, Secure o SameSite, exponiendo el hash de la contraseña al cliente. El sufijo de baja entropía actúa como un identificado...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 🚨 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 📝 Description The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.4.01. This flaw...

CVE-2026-88038

A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...

CVE-2025-28121

💥 CVE-2025-28121 - Reflected XSS in Online Exam Mastering System 1.0 📝 Description code-projects Online Exam Mastering System 1.0 is vulnerable to Reflected Cross-Site Scripting XSS in the feedback.php file via the q parameter. This issue allows remote attackers to inject malicious JavaScript int...

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...