HTB-Silentium-Writeup

HTB - Writeup de Silentium Información de la Máquina Nombre: Silentium SO: Linux Dificultad: Fácil CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeración Escaneo con Nmap nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Puertos abiertos: 22 SSH, 80 HTTP Hosts virtualesstaging.silentium.htb...

CVE-2024-10508

Escalada de privilegios no autenticada a través de la recuperación de contraseña en RegistrationMagic = 6.0.2.6 Aviso legal : Esta información se proporciona únicamente con fines educativos. Este documento pretende concienciar sobre las vulnerabilidades de seguridad y no debe utilizarse para...

CVE-2025-63314

CVE-2025-63314 - Acora CMS 中密码重置令牌处理不当漏洞 由印度 Crowe 的 Joby Y Daniel 发现 📌 概述 DDSN Interactive cm3 Acora CMS 版本 10.7.1 在其密码重置功能中存在安全漏洞。 该应用程序使用了一个静态且持久的密码重置令牌，该令牌在使用后不会被失效，且不会随时间过期。 此缺陷允许获取有效重置令牌的攻击者无限期重复使用该令牌，从而导致账户接管 ，包括特权用户账户 。 🛠 受影响产品 产品名称： cm3 Acora CMS 供应商： DDSN Interactive 受影响版本： 10.7.1 组件：...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

Flowise-CVE-2025-58434-Chain-59528

FlowiseAI CVE 链 - 账户接管 CVE-2025-58434 与远程代码执行 CVE-2025-59528 ⚠️ 仅供教育和授权的安全研究使用。 在未经拥有或缺少书面许可的系统上运行此工具是非法的 。 目录 本仓库包含一个 Python 概念验证，用于串联两个 Flowise 漏洞： CVE-2025-58434 — 通过暴露的密码重置令牌行为实现账户接管。 CVE-2025-59528 — 通过在 CustomMCP 节点中对 JavaScript 进行不安全求值实现远程代码执行。 Flowise 是一个用于构建 LLM 应用和 AI...

CVE-2022-24181

CVE-2022-24181 和 CVE-2022-26616。两者可能相同 Open-journal-system-漏洞 通过主机头注入的XSS及窃取其他用户的密码重置令牌 复现步骤： 1. 访问此网站：https://who's-using-ojs-software.com 2. 在Burp中捕获此请求，并发送到Repeater。 3. 在Host Header之后添加此内容：X-Forwarded-Host: foo"x=".com 4. 然后点击发送，之后右键点击请求并选择在浏览器中显示响应，然后复制该请求。 5. 在浏览器中粘贴此请求，你会看到XSS弹窗。...

CVE-2025-50433

CVE-2025-50433 — 影响Monnit云平台.imonnit.com的严重账户接管漏洞 摘要 .imonnit.com 存在一个严重的认证漏洞，允许完全账户接管（ATO） 任何用户账户，且无需受害者交互。 后端未能验证密码重置令牌与目标电子邮件之间的关联 ，导致攻击者可以使用自己有效的重置令牌来重置任何受害者账户的密码。 攻击向量（逐步PoC） 1. 攻击者创建账户 A（[email protected]）。 2. 受害者拥有账户 B（[email protected]）。 3. 攻击者为账户 A 和 B 请求密码重置。 4. 攻击者仅收到账户 A...

CVE-2024-34327

CVE-2024-34327 SQL注入漏洞检查器 本脚本（V-24-02-001SQLiCheck.py）是一个概念验证（PoC）工具，用于验证 CVE-2024-34327所标识的、影响password-reset-token.php端点的基于时间的盲SQL注入漏洞 。 ⚠️ 免责声明 本工具仅供教育和授权测试目的使用 。未经同意擅自扫描或利用系统是非法且不道德的。 🔍 漏洞详情 CVE ID ：CVE-2024-34327 漏洞标题 ：基于时间的盲SQL注入 产品 ：Sielox AnyWare 受影响版本 ：2.1.2 存在漏洞的端点...

HackerOne: HackerOne Code sends live password-reset tokens to Segment in automatic page events

A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

FreeBSD : phpmyfaq -- multiple vulnerabilities (7a691536-968b-11f1-9863-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7a691536-968b-11f1-9863-50ebf6bdf8e9 advisory. phpMyFAQ team reports: The WebAuthn login flow never persists the challenge it issues, so the replay...

CVE-2026-39923: Use of a Key Past its Expiration Date

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

EUVD-2026-51068

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-53646

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client from a previous unexpired reset request, subsequent calls to the resetpassword guest API endpoint reuse the existing token instea...

PT-2026-56039

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.6 through 0.7.2 Description When a ClientPasswordReset record already exists for a client from a previous unexpired request, subsequent calls to the reset password guest API endpoint reuse the existing token instead of...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...