Flowise-CVE-2025-58434-Chain-59528

Цепочка CVE FlowiseAI - ATO CVE-2025-58434 и RCE CVE-2025-59528 ⚠️ Только для образовательных целей и авторизованных исследований безопасности. Запуск этого инструмента против систем, которыми вы не владеете или на тестирование которых у вас нет письменного разрешения, незаконен. Содержание Этот...

CVE-2024-10508

Неаутентифицированное повышение привилегий через восстановление пароля в RegistrationMagic = 6.0.2.6 Отказ от ответственности : Эта информация предоставлена только в образовательных целях. Этот документ направлен на повышение осведомленности об уязвимостях безопасности и не должен использоваться...

CVE-2022-24181

CVE-2022-24181 и CVE-2022-26616, вероятно, одинаковы Уязвимость Open-journal-system XSS через инъекцию заголовка Host и кража токена сброса пароля другого пользователя Шаги для воспроизведения: 1. Перейдите на этот сайт: https://who's-using-ojs-software.com 2. Захватите этот запрос в Burp и...

HTB-Silentium-Writeup

HTB - Silentium 라이트업 머신 정보 이름: Silentium OS: Linux 난이도: 쉬움 CVE: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 정보 수집 Nmap 스캔 root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt 열린 포트: 22 SSH, 80 HTTP 가상 호스트 — staging.silentium.htb는 Flowise 3.0.5 를 실행 중 발판 — Flowise RCE CVE-2025-58434 — 인증...

CVE-2025-63314

CVE-2025-63314 - Некорректная обработка токена сброса пароля в Acora CMS Обнаружено Джоби Й. Дэниелом из Crowe India 📌 Обзор DDSN Interactive cm3 Acora CMS версии 10.7.1 содержит уязвимость безопасности в функции сброса пароля. Приложение использует статический и постоянный токен сброса пароля,...

CVE-2025-50433

CVE-2025-50433 — Критическая уязвимость перехвата аккаунтов, затрагивающая облачные платформы Monnit .imonnit.com Краткое описание Критическая уязвимость аутентификации существует в .imonnit.com, позволяющая полный перехват управления аккаунтом Account Takeover, ATO любого пользователя без...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

CVE-2024-34327

CVE-2024-34327 SQL-Injection-Schwachstellenprüfer Dieses Skript V-24-02-001SQLiCheck.py ist ein Proof-of-Concept PoC -Tool, um das Vorhandensein einer zeitbasierten blinden SQL-Injection-Schwachstelle zu überprüfen, die den Endpunkt password-reset-token.php betrifft, identifiziert als...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

EUVD-2026-51068

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-53646

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client from a previous unexpired reset request, subsequent calls to the resetpassword guest API endpoint reuse the existing token instea...

PT-2026-56039

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.6 through 0.7.2 Description When a ClientPasswordReset record already exists for a client from a previous unexpired request, subsequent calls to the reset password guest API endpoint reuse the existing token instead of...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...

CVE-2026-47376 NocoDB: Reflected Cross-Site Scripting via Password Reset Token

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or...

PT-2026-51627

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Password-reset tokens are generated using the account-activation lifetime conf.Auth.ActivateCodeLives instead of the intended password-reset lifetime conf.Auth.ResetPasswordCodeLives. Because the token...

EUVD-2026-36292

PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker only needs a registered account and a...

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default and documented configuration, so LSHttpRequest::checkIsAllowedHost results in no operation....