cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — Contournement d'authentification non authentifié JFrog Artifactory → prise de contrôle admin CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · divulgué le 28/08/2026 · exploité dans la nature. Un attaquant non authentifié, adjacent au réseau, génère un jeton d'accès...

demo-cve-2022-21449

Demo Project: CVE-2022-21449 Vulnerability This project demonstrates the CVE-2022-21449 vulnerability, which affects Java's ECDSA signature verification. The vulnerability allows a malicious actor to bypass signature verification by using a signature with zero values r=0 and s=0. The project uses...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : Proof of Concept Proof of concept for the CVE-2022-39227. According to this CVE, there is a flaw in the JSON Web Token verification. It is possible with a valid token to re-use its signature with modified claims. Required: 1. A valid JSON Web Token. 2. The backend...

CVE-2025-30144

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Members : Abhishek Rungta, Shubham Saini, Siddhant Sood Environment Setup A linux VM Such as Ubuntu 20.04 Minikube for local deploymnet of kubernetes Any of these older versions1.0.x— 1.9.x, 1.10.0—1.10.10,1.11.0—1.11.4,1.12.0—1.12.2 Run the exploit We have...

ClaimJumper

root@kitploit: / | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability...

CVE-2018-0114-PoC

CVE-2018-0114 PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Example root@kitploit: $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid':...

CVE-2018-0114

CVE-2018-0114 استغلال لـ Node-jose 0.11.0 مكتوب بلغة Ruby الاستخدام فقط أدخل اسم الضحية في الكود ثم شغّل الملف عبر ruby ./exploit.rb ثغرة في مكتبة node-jose مفتوحة المصدر من Cisco قبل الإصدار 0.11.0 قد تسمح لمهاجم بعيد غير مصادق بإعادة توقيع الرموز tokens باستخدام مفتاح مضمّن داخل الرمز نفسه. تعو...

JWT-Bruteforcer

JWT-Bruteforcer Basic Jwt Bruteforcer tool with CVE-2018-1000531 Vulnerability Test Imported libraries: jwt base64 Requires minimum version of python 3.6...

CVE-2025-9209

🍔 RestroPress – ऑनलाइन खाद्य आदेश प्रणाली 3.0.0 - 3.1.9.2 🛡️ CVE-2025-9209.py — बड़े पैमाने पर स्वचालित शोषण एवं निष्कर्षण उपकरण ⚠️ भेद्यता अवलोकन RestroPress – ऑनलाइन खाद्य आदेश प्रणाली संस्करण 3.0.0 से 3.1.9.2 एक अप्रमाणित सूचना प्रकटीकरण से प्रभावित हैं जो जाली JWT के माध्यम से प्रमाणीकरण बाइपास...

CVE-2026-29000

تجاوز المصادقة عبر JWT/JWE - إثبات المفهوم PoC نص برمجي لإثبات المفهوم PoC يوضح ثغرة تجاوز المصادقة باستخدام رموز JSON Web Tokens JWT وتشفير JSON Web Encryption JWE. تستغل هذه الأداة البيئات التي تتحقق بشكل غير صحيح من خوارزميات الرموز بقبولها رموز JWT غير موقّعة alg: none داخل بنية JWE صالحة. كي...

poc-cribl-rce

إخلاء المسؤولية هذا للأغراض المعلوماتية/التعليمية فقط. تم تجميع هذا لإظهار نقطة ضعف في الأداة، وذلك للتحقق من الإصلاح من قبل البائع. معلومات تم الاختبار على Cribl الإصدار 1.5.0 - الإصدارات السابقة لم يتم اختبارها ولكنها على الأرجح معرضة للخطر. يمكن نقل رمز JWT صالح من وحقنه في جلسة مثيل Cribl آخر...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

EUVD-2026-69383

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115

Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass.

Summary golang-jwt/jwt is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2024-51744, CVE-2025-30204. Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: دالة CheckToken الخاصة بـ JWT لا تعيد التحقق من حالة الحساب أبدًا المنتج: go-shiori/shiori الملف: internal/domains/auth.go CWE: CWE-613 — انتهاء صلاحية الجلسة غير كافٍ CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 مرتفع CNA: Turan Security · سجل CVE الوصف تتحقق دالة...

CVE-2026-55040

Contournement de l'authentification JWT de Microsoft SharePoint CVE-2026-55040 Aperçu CVE-2026-55040.py est un script de preuve de concept pour exploiter la vulnérabilité de contournement de l'authentification SharePoint, CVE-2026-55040. Pour une analyse technique complète, consultez notre Analys...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...