CVE-2023-27524

CVE-2023-27524: Bypass dell'autenticazione di Apache Superset Script per verificare se un server Apache Superset è in esecuzione con una configurazione predefinita non sicura CVE-2023-27524. Lo script verifica se i cookie di sessione di un server Superset sono firmati con una delle note chiavi...

Apache-Superset-SECRET_KEY-CVE-2023-27524-

Apache-Superset-SECRETKEY-CVE-2023-27524-...

CVE-2023-27524-POC

CVE-2023-27524: Apache Superset Bypass dell'autenticazione Script per verificare se un server Apache Superset è vulnerabile a CVE-2023-27524 e, se è vulnerabile, forgiare un cookie di sessione con userid = 1, che di solito è l'utente admin, consentendo il bypass dell'autenticazione e l'accesso al...

Grafana-Decryptor-for-CVE-2021-43798

Decriptor Grafana per CVE-2021-43798 Questo script decripta le password delle DataSource da un'istanza Grafana vulnerabile a CVE-2021-43798, che consente la lettura non autorizzata di file arbitrari. Descrizione Le versioni di Grafana dalla 8.0.0-beta1 alla 8.3.0 sono vulnerabili a una...

CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

CVE-2023-27524: Bypass di Autenticazione e RCE in Apache Superset Apache Superset, uno strumento open-source ampiamente utilizzato per la visualizzazione e l'esplorazione dei dati, è stato identificato come avente potenziali debolezze di sicurezza che potrebbero portare a bypass di autenticazione...

CVE-2026-108264

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

EUVD-2026-95995

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2023-27524

CVE-2023-27524 Descrizione - POC per CVE-2023-27524: vulnerabilità di bypass dell'autenticazione in Apache Superset. - creato da antx il 2023-04-27. Dettagli - Attacchi di convalida delle sessioni in Apache Superset versioni fino alla 2.0.1 inclusa. Le installazioni che non hanno modificato la...

CVE-2025-3102

🔐 CVE-2025-3102 – Bypass dell'autenticazione nel plugin WordPress SureTriggers 🚨 CVE-2025-3102 è una vulnerabilità critica di bypass dell'autenticazione che colpisce il plugin WordPress SureTriggers: All-in-One Automation Platform , installato attivamente su oltre 100.000 siti web. Data la natura...

GHSA-JXW3-MJMX-3PQM Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

Langflow: Weak Fernet Key via random.seed()

Summary Langflow uses Python's random module Mersenne Twister, a non-cryptographic PRNG seeded with the SECRETKEY to derive the Fernet encryption key for all stored user credentials API keys, LLM provider secrets, database passwords. When the SECRETKEY is shorter than 32 characters — a common...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392

A vulnerability exists in Lybbn Django-Vue-Lyadmin up to version 3.2.12 due to a hard-coded cryptographic key within the JWT Signing component. Specifically, the manipulation of the SECRET_KEY argument in backend/application/settings.py leads to the use of this hard-coded key. Remote exploitation...

EUVD-2026-92777

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105392 Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRETKEY leads to use of hard-coded cryptographic key . Remote...

CVE-2026-105641

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Implementazione in Python di uno strumento per decifrare e cifrare dati sensibili in Grafana, affrontando specificamente le vulnerabilità associate a CVE-2021-43798. Grafana cifra tutte le password delle fonti dati utilizzando l'algoritmo AES con la secretkey presente nel...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641

The open-source project management tool Plane contains hardcoded credentials in its community deployment manifests prior to version 1.4.0 . Specifically, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known defaults for SECRET_KEY and LIVE_SERVER_S...

EUVD-2026-92597

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...