WebLogic-Shiro-shell

Java Deserialization Technology Sharing This sharing covers the following points: 1. Java Serialization and Deserialization Basics 2. Why do vulnerabilities occur during deserialization? 3. Java Reflection 4. ysoserial CommonsCollections2, CommonsCollections5 5. Java ClassLoader: Several methods...

ecologyExp.jar

ecologyExp.jar Weaver OA database configuration file reader java -jar ecologyExp.jar http://127.0.0.1 Source Code package com.test; import org.apache.http.HttpEntity; import org.apache.http.client.methods.CloseableHttpResponse; import org.apache.http.client.methods.HttpGet; import...

CVE-2025-56801

CVE-2025-56801 AES-CFB IV Generation Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-1204: Generation of Weak Initialization Vector IV, CWE-321: Use of Hard-coded Cryptographic Key CVSS : 5.1 MEDIUM Vector...

publiccms_decrypt

publiccmsdecrypt https://github.com/sanluan/PublicCMS publiccms-core-V4.0.202004.a.jar!/com/publiccms/common/constants/CommonConstants.class publiccms-common-V4.0.202004.a.jar!/com/publiccms/common/tools/VerificationUtils.class com.publiccms.common.tools.VerificationUtils...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

CVE-2026-79551-Tenda

CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...

nfc-ic-keys-dict

nfc-ic-keys-dict 2021-05-31 nfcPro.exe early version download http://www.nsccn.com/web/soft/win/20210531/nfcPro.exe keys for ic: 1D14130D1A0B/000000000000 How to detect the type of an iC card: Google Play Store = MIFARE Classic Tool = Tools = Show Tag Info root@kitploit: UID: xxxxx 4 byte RF...

CVE-2016-4437

shiro-1.2.4 Vulnerability Tool Decrypt rememberMe value and export corresponding class file Usage xk-mt-rememberMe解码.py Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After...

zte-smartlife-app-pwned

ZTE SmartLife Security Findings Leading to Account Takeover T...

CVE-2016-4437

CVE-2016-4437 Python POC to Exploit CVE-2016-4437 Apache Shiro Deserialization Vulnerability Due to Hardcoded Encryption Key Example Usage: ./CVE-2016-4437.py -c nslookup -u https://example.com/ -i ecsepnkqtxlishpynfdge01543e4vmx7v.oast.fun See comments and the code for more information...

CVE-2026-86555

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...

CVE-2026-86555 Hardcoded Key Vulnerability in ZTE SmartLife APP

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...

CVE-2026-86555

The ZTE SmartLife mobile application contains a hardcoded key used to decrypt account server information. The key is stored in plaintext within the application code, so an attacker with access to the binary can extract it and decrypt the protected server configuration data. The CVSS v3.1 score is...

EUVD-2026-83717

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...

CVE-2026-86555 Hardcoded Key Vulnerability in ZTE SmartLife APP

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...

CVE-2020-9289

Decrypt FortiManager configuration secrets CVE-2020-9289 CVE-2020-9289 and CVE-2019-6693 are related to the same default and hardcoded key. The only differences on the decryption routine implemented in FortiManager/FortiAnalyzer are: The IV handling all the 16 bytes are provided before the...

SSCMS_Decrypt

sscms siteserver cms database decrypt Introduction: SSCMS is based on .NET Core, enabling you to set up a fully functional, high-performance, large-scale, and easy-to-maintain website platform in the shortest time, at the lowest cost, and with the least manpower. Project address:...

redash-reset

redash-reset This will use a default REDASHSECRETKEY key of c292a0a3aa32397cdb050e233733900f this allows you to reset the password of the user ID but you will need to know the email address assocaited with it. Info https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv Setup...

CVE-2026-54767

WeGIA , a web manager for charitable institutions, is affected by a critical (CVSS 9.1) vulnerability prior to version 3.8.5 . The file deletar_socios.php exposes an unauthenticated GET endpoint where the chave parameter is validated only against a hardcoded chave_correta value embedded in the pu...

CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...