Gogs_RCE

GogsRCE 漏洞复现 0x01 前台注册普通账号 0x02 go 编译伪造管理员session go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj gob.Registerv buf := bytes.NewBuffernil err := gob.NewEncoderbuf.Encodeobj return...

CVE-2023-27524-POC

CVE-2023-27524：Apache Superset 认证绕过 该脚本用于检查 Apache Superset 服务器是否存在 CVE-2023-27524 漏洞，如果存在漏洞，则伪造一个 userid = 1（通常为 admin 用户）的会话 Cookie，从而实现认证绕过并获取仪表盘的访问权限。目前，全球约有 3000 台服务器运行 Apache Superset。 用法 usage: python3 CVE-2023-27524.py --url URL 基本示例 % python3 CVE-2023-27524.py --url...

cpanel-sessionscribe

SessionScribe - CVE-2026-41940 cPanel 和 WHM 中的严重未认证 RCE。 四个 HTTP 请求即可通过向预认证会话的密码字段注入 CRLF 来伪造 root 会话。 无需认证、无需任何前置条件，所有受支持的版本分支均受影响。 由 Sina Kheirkhah 于 2026-04-28 披露 / watchTowr Labs。 快速入门 · ioc-scan · mitigate · remote-probe · 受影响版本 · 优先级顺序 !IMPORTANT 112、114、116、120、122、128 分支没有供应商补丁。 这些...

CVE-2026-19490

CVE-2026-19490 — Bypass de autenticación SAML en NetScaler ADC/Gateway Falsificación de sesión no autenticada en Citrix NetScaler ADC / NetScaler Gateway a través del manejador de enlace HTTP-Redirect SAML en GET /cgi/samlauth. CVSS 4.0 9.3, CWE-288. Boletín CTX696939 2026-08-19, sin workarounds...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM 认证绕过 + Root 密码修改器 此脚本利用 cPanel/WHM 上的认证绕过漏洞（CVE-2026-41940），通过 CRLF 注入技术伪造管理员会话。成功利用后，脚本可在 WHM 中修改 root 用户的密码，并通过 Telegram 发送通知。 警告：仅用于对您拥有或已获得书面授权的系统进行安全测试。滥用此脚本进行非法访问违反法律。 📦 安装依赖（PIP） 此脚本需要 Python 3.6+ 和两个外部库。运行以下命令： pip install requests urllib3 requests – 用于发送灵活的 HT...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X 重建分析 CVE-2026-21858：Ni8mare - n8n RCE 全链路利用 1. 执行摘要与概述 本文档对 CVE-2026-21858 漏洞（内部代号 Ni8mare）进行了确定性的技术重建分析。该漏洞的 CVSS 评分为 10.0（严重），存在于 n8n 自动化平台的 Form Webhook 节点中。该缺陷属于 Content-Type 混淆漏洞，可允许未经身份验证的攻击者执行任意文件读取、会话伪造，并最终通过"Execute...

CVE-2026-61500

CVE-2026-61500：Rejetto HFS 会话伪造导致 RCE CVE-2026-61500 是 Rejetto HFS 3.0.0 至 3.2.0 中的一个未认证会话伪造漏洞。HFS 使用 JavaScript Math.random 生成其 Koa 会话 cookie 签名密钥，并在未认证的 SRP 登录握手中暴露了来自同一 V8 PRNG 的输出。攻击者可以重建 PRNG 状态、恢复签名密钥、伪造管理员会话，并利用文档中记载的 servercode 配置功能执行服务端 JavaScript。 本仓库包含一个 Python 概念验证，以及使用官方 HFS 3.2.0 和...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

Cisco Secure Firewall Management Center Software Vulnerabilities

Multiple vulnerabilities in Cisco Secure Firewall Management Center FMC Software could allow a remote attacker to gain root access and perform session forgery or session impersonation. For more information about these vulnerabilities, see the Details "details" section of this advisory. Cisco has...

CVE-2026-92749: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-46696

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696

CVE-2026-46696 affects October CMS (system module) versions prior to 3.7.17 and 4.2.21 . A chained bypass in the Twig sandbox security policy occurs when cms.safe_mode is enabled: the Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through ...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across th...

GHSA-XV9M-FM3W-8W5X October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across th...

Astra Linux – Vulnerability in Zabbix

A bug in the code allows an attacker to create a forged zbxsession cookie, which enables them to log in with admin permissions...

PT-2026-91277

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safe mode is enabled. The Laravel session store was exposed to Twig with unrestricte...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...