7634 matches found
CVE-2026-41940
Based on Watch Tower POC , Supports direct shell access via websocket , and adding root api keys for persistance...
CVE-2026-34828
CVE-2026-34828 listmonk’s Session Persistence After Password Reset and Password Change Intro I found this issue while reviewing listmonk , an open-source newsletter and mailing list manager, with a simple security question in mind: When a user changes or resets a password, does the application...
ubercookie
🍪 ubercookie An educational demonstration of how websites persistently identify you — and why "clear your cookies" is no longer enough. ubercookie plants a single random id into 12 different browser storage vectors at once. Every time you visit, it reads them all, takes a consensus, and re-writes...
CVE-2025-24813
Description This repository is an environment for reproducing the latest RCE of CVE-2025-24813 Tomcat. For learning and research purposes only! Exploitation Conditions The application has enabled the DefaultServlet write functionality, which is disabled by default. The application supports partia...
CVE-2025-24813-POC
CVE-2025-24813: Apache Tomcat RCE Proof of Concept This repository provides a controlled, automated environment to demonstrate Remote Code Execution RCE vulnerabilities in Apache Tomcat via CVE-2025-24813. Overview This PoC exploits misconfigured file-based session persistence in Apache Tomcat's...
react-cve-2025-55182
react-cve-2025-55182 This is a dump of malware and other suspicious junk I found on the server for my wedding website following the react server side rendering code execution exploit. Its a dinky digital ocean droplet running a fairly pedestrian next js app. The CVE:...
java-vulnerable
Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...
casper-shell
🦇 Casper@shell: - Shell Web PHP Avanzado Casper@shell: es una versión mejorada y más fácil de usar de p0wny shell, con muchas nuevas funcionalidades. Esta versión tiene como objetivo ser más útil para realizar rápidamente reconocimiento, exfiltración o implementar mecanismos de persistencia. ✨...
GhostTrace
GhostTrace Encuentra lo que el software dejó atrás en Windows, antes de que regrese. GhostTrace es un cazador local de rastros forenses de Windows para respondedores de incidentes, administradores de sistemas y usuarios avanzados con mentalidad de seguridad. Mapea persistencia, ejecución, activid...
Session-Persistence-After-Enabling-2FA-CVE-2025-60425
Persistencia de sesión después de habilitar 2FA Resumen La aplicación Nagios Fusion versiones 2024R1.2 y 2024R2 contiene una falla de seguridad alta donde las sesiones existentes siguen siendo válidas incluso después de habilitar la Autenticación de Dos Factores 2FA. Específicamente, cuando se...
PT-2026-107515
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF...
UBUNTU-CVE-2026-106553
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...
CVE-2026-106553
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
EUVD-2026-94061
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
AZL-106706 CVE-2026-106553 affecting package openssh 9.8p1-10
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...
CVE-2026-106553
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...
CVE-2026-106553
The sshd component in OpenSSH versions prior to 10.6 is vulnerable to a flaw where credentials can incorrectly persist following a failed GSSAPIAuthentication attempt. This issue is associated with CWE-669 (Incorrect Resource Transfer Between Spheres). While the provided documents do not specify ...
