ecologyExp.jar

ecologyExp.jar Lectura del archivo de configuración de la base de datos de Weaver OA java -jar ecologyExp.jar http://127.0.0.1 Código fuente package com.test; import org.apache.http.HttpEntity; import org.apache.http.client.methods.CloseableHttpResponse; import...

CVE-2016-4437

shiro-1.2.4 Vulnerability Tool Decrypt rememberMe value and export corresponding class file Usage xk-mt-rememberMe解码.py Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After...

WebLogic-Shiro-shell

Compartir técnica de deserialización de Java Los aspectos cubiertos en esta presentación son los siguientes: 1. Conceptos básicos de serialización y deserialización de Java 2. ¿Por qué se generan vulnerabilidades durante la deserialización? 3. Reflexión de Java 4. ysoserial...

publiccms_decrypt

publiccmsdecrypt https://github.com/sanluan/PublicCMS publiccms-core-V4.0.202004.a.jar!/com/publiccms/common/constants/CommonConstants.class publiccms-common-V4.0.202004.a.jar!/com/publiccms/common/tools/VerificationUtils.class com.publiccms.common.tools.VerificationUtils...

CVE-2020-9289

Decrypt FortiManager configuration secrets CVE-2020-9289 CVE-2020-9289 and CVE-2019-6693 are related to the same default and hardcoded key. The only differences on the decryption routine implemented in FortiManager/FortiAnalyzer are: The IV handling all the 16 bytes are provided before the...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

SSCMS_Decrypt

sscms siteserver cms database decrypt Introduction: SSCMS is based on .NET Core, enabling you to set up a fully functional, high-performance, large-scale, and easy-to-maintain website platform in the shortest time, at the lowest cost, and with the least manpower. Project address:...

redash-reset

redash-reset Esto utilizará una clave REDASHSECRETKEY predeterminada de c292a0a3aa32397cdb050e233733900f, lo que permite restablecer la contraseña del ID de usuario, pero necesitará conocer la dirección de correo electrónico asociada a él. Información...

CVE-2025-56801

CVE-2025-56801 AES-CFB IV Generation Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-1204: Generation of Weak Initialization Vector IV, CWE-321: Use of Hard-coded Cryptographic Key CVSS : 5.1 MEDIUM Vector...

CVE-2026-87929

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87930

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

CVE-2026-87929

MaxSite CMS through version 109.6 contains a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Because the key is publicly known, an unauthenticated attacker can compute an HMAC-SHA1 signature to mint a malicious ci_session cookie with ad...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

EUVD-2026-75112

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

nfc-ic-keys-dict

nfc-ic-keys-dict 2021-05-31 nfcPro.exe early version download http://www.nsccn.com/web/soft/win/20210531/nfcPro.exe keys for ic: 1D14130D1A0B/000000000000 How to detect the type of an iC card: Google Play Store = MIFARE Classic Tool = Tools = Show Tag Info root@kitploit: UID: xxxxx 4 byte RF...

CVE-2016-4437

CVE-2016-4437 POC en Python para explotar la vulnerabilidad de deserialización CVE-2016-4437 de Apache Shiro debido a una clave de cifrado codificada Ejemplo de uso: ./CVE-2016-4437.py -c nslookup -u https://example.com/ -i ecsepnkqtxlishpynfdge01543e4vmx7v.oast.fun Consulte los comentarios y el...

CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

CVE-2026-18330

A hard-coded shared RSA-1024 private key vulnerability exists in the web module of the TP-Link Archer AX55 v4 . A LAN attacker who captures an HTTP login session can use the known shared private key to decrypt the administrator password , and a weakened AES session key further reduces the effort ...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...