PT-2025-12086 · Unknown · Gpt Academy

Name of the Vulnerable Software and Affected Versions: GPT Academy version 3.83 Description: GPT Academy version 3.83 is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server...

CVE-2024-12137

Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01...

CVE-2024-12137

Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01...

CVE-2024-12137

CVE-2024-12137 concerns Elfatek Elektronics ANKA JPD-00028 (affected up to before V.01.01). The root cause is a capture-replay/authentication bypass enabling session hijacking. The issue is evaluated with CVSS v3.1: AV:A, AC:L, PR:N, UI:R, S:U, C:L, I:H, A:H, giving a base score of 7.6 (HIGH). Im...

CVE-2024-12137 Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028

Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01...

CVE-2024-12137 Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028

Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01...

Elfatek Elektronics ANKA JPD00028 安全漏洞

Elfatek Elektronics ANKA JPD00028 is a radio remote control system from Elfatek Elektronics. A security vulnerability exists in Elfatek Elektronics ANKA JPD00028 version 19.03.2025 and earlier, which stems from a capture replay attack that could lead to session hijacking...

Session Hijacking

flarum/core is vulnerable to Session Hijacking. The vulnerability is due to improper scoping of cookies, allowing an attacker-controlled subdomain to set cookies for the parent domain...

CVE-2025-24856

An issue was discovered in the oidc aka OpenID Connect Authentication extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: 1 an attacker can anticipate the...

K000150406: jQuery vulnerability CVE-2007-2379

Security Advisory Description The jQuery framework exchanges data using JavaScript Object Notation JSON without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and...

CVE-2025-24856

An issue was discovered in the oidc aka OpenID Connect Authentication extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: 1 an attacker can anticipate the...

CVE-2025-24856

An issue was discovered in the oidc aka OpenID Connect Authentication extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: 1 an attacker can anticipate the...

CVE-2025-24856

An issue was discovered in the oidc aka OpenID Connect Authentication extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: 1 an attacker can anticipate the...

CVE-2025-24856

TYPO3 OpenID Connect (oidc) extension vulnerability predates v4.0.0. The account linking logic allows a pre-hijacking attack: an attacker who can guess a user’s email, register a public frontend account with that email before the user’s first OIDC login, and rely on the IDP returning that email i...

CVE-2025-27794

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...

SUSE CVE-2025-27088

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

MRCMS Product Cross-Site Scripting Vulnerability

MRCMS is a content management system. A cross-site scripting vulnerability exists in MRCMS, which stems from insufficient filtering of operations on parameter names/paths, allowing an attacker to inject malicious scripts. The vulnerability can be exploited to inject malicious scripts, which will ...

Autodesk: Twitter broken link hijacking in thewild.com

A broken link hijacking vulnerability was discovered on thewild.com. The issue was reported and subsequently fixed by Autodesk...

Cisco Secure Client has a data forgery issue vulnerability

Cisco Secure Client is a software for connecting to virtual private networks from the American company Cisco Cisco. Cisco Secure Client has a data forgery issue vulnerability that stems from insufficient runtime resource validation, which can be exploited by an attacker to cause a DLL hijacking...

GHSA-HG9J-64WP-M9PX Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Summary A session hijacking vulnerability exists when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement for applications hosted on sibling subdomains e.g.,...