Flowise-CVE-2025-58434-Chain-59528

Catena CVE di FlowiseAI - ATO CVE-2025-58434 e RCE CVE-2025-59528 ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento su sistemi di cui non si è proprietari o senza permesso scritto è illegale. Indice dei contenuti Questo repository contiene un proof-of-concep...

HTB-Silentium-Writeup

HTB - Writeup di Silentium Informazioni sulla macchina Nome: Silentium OS: Linux Difficoltà: Facile CVE: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumerazione Scansione Nmap root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Porte aperte: 22 SSH, 80 HTTP Host...

CVE-2024-10508

Escalação de Privilégio Não Autenticada via Recuperação de Senha no RegistrationMagic = 6.0.2.6 Aviso Legal : Essas informações são fornecidas apenas para fins educacionais. Este documento visa conscientizar sobre vulnerabilidades de segurança e não deve ser usado para atividades não autorizadas ...

CVE-2025-63314

CVE-2025-63314 - Tratamento Inadequado de Token de Redefinição de Senha no Acora CMS Descoberto por Joby Y Daniel da Crowe India 📌 Visão Geral O cm3 Acora CMS versão 10.7.1 da DDSN Interactive contém uma vulnerabilidade de segurança na funcionalidade de redefinição de senha. A aplicação utiliza u...

CVE-2024-34327

CVE-2024-34327 SQL注入漏洞检查器 本脚本（V-24-02-001SQLiCheck.py）是一个概念验证（PoC）工具，用于验证 CVE-2024-34327所标识的、影响password-reset-token.php端点的基于时间的盲SQL注入漏洞 。 ⚠️ 免责声明 本工具仅供教育和授权测试目的使用 。未经同意擅自扫描或利用系统是非法且不道德的。 🔍 漏洞详情 CVE ID ：CVE-2024-34327 漏洞标题 ：基于时间的盲SQL注入 产品 ：Sielox AnyWare 受影响版本 ：2.1.2 存在漏洞的端点...

CVE-2025-50433

CVE-2025-50433 — Vulnerabilidade Crítica de Apropriação de Conta que Afeta as Plataformas Monnit Cloud .imonnit.com Resumo Existe uma vulnerabilidade crítica de autenticação em .imonnit.com que permite a apropriação total de conta ATO em qualquer conta de usuário sem interação da vítima. O backen...

CVE-2022-24181

CVE-2022-24181 e CVE-2022-26616. Ambos são provavelmente iguais. Open-journal-system-Vulnerability XSS via injeção de Host Header e roubo do token de redefinição de senha de outro usuário Passos para reproduzir: 1. Acesse este site: https://who's-using-ojs-software.com 2. Capture esta solicitação...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

EUVD-2026-51068

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-53646

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client from a previous unexpired reset request, subsequent calls to the resetpassword guest API endpoint reuse the existing token instea...

PT-2026-56039

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.6 through 0.7.2 Description When a ClientPasswordReset record already exists for a client from a previous unexpired request, subsequent calls to the reset password guest API endpoint reuse the existing token instead of...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...

CVE-2026-47376 NocoDB: Reflected Cross-Site Scripting via Password Reset Token

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or...

PT-2026-51627

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Password-reset tokens are generated using the account-activation lifetime conf.Auth.ActivateCodeLives instead of the intended password-reset lifetime conf.Auth.ResetPasswordCodeLives. Because the token...

EUVD-2026-36292

PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker only needs a registered account and a...

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default and documented configuration, so LSHttpRequest::checkIsAllowedHost results in no operation....