CVE-2018-18925

CVE-2018-18925 Sfruttamento di CVE-2018-18925, una Remote Code Execution contro lo strumento Git self-hosted: Gogs. Gogs si basa sul framework Macaron. Il sistema usato per gestire la sessione è molto simile a quello che fa PHP. L'identificatore di sessione nel cookie è mappato a un file sul...

Superset_auth_bypass_check

Supersetauthbypasscheck Tool zur Erkennung der Apahce-Superset-Authentifizierungsumgehung-Schwachstelle CVE-2023-27524 Behoben am: 3.8.2023 Behoben: Sitzungsfehler aufgrund abgelaufener hartcodierter Sitzungszeiträume; Ersetzung durch das Tool flasksessioncookiemanager zur Generierung von...

TOTPAuthenticate

TOTP Authenticate Usa le regole di gestione delle sessioni per aggiungere un token TOTP alle richieste in uscita. Per Burp Suite Enterprise Edition Tieni presente che le estensioni sono scritte da utenti terzi di Burp e PortSwigger non fornisce alcuna garanzia sulla loro qualità o utilità per...

CVE-2026-41940

CVE-2026-41940 - Exploit di massa di bypass dell'autenticazione WHM/cPanel 📋 Descrizione CVE-2026-41940 è una vulnerabilità critica di bypass dell'autenticazione in WHM/cPanel che consente agli aggressori di eludere l'autenticazione e ottenere accesso root a un server senza credenziali valide. La...

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

cve-2018-11714_POC

cve-2018-11714POC Um problema foi descoberto no TP-Link TL-WR840N. Esse problema é causado pelo manuseio incorreto de sessão na pasta /cgi/ ou em um arquivo /cgi. Se um atacante enviar um cabeçalho "Referer: http://192.168.0.1/mainFrame.htm", nenhuma autenticação será necessária para qualquer açã...

auth_analyzer

Auth Analyzer Indice Cos'è? Perché dovrei usare Auth Analyzer? Panoramica GUI Estrazione dei Parametri Estrazione Automatica Da Stringa a Stringa Valore Statico Richiedi Input Sostituzione dei Parametri Posizione di Sostituzione Rimozione dei Parametri Esempi di Utilizzo Estrazione automatica del...

cve-2023-30861-poc

CVE-2023-30861 PoC Proof of Concept ⚠️ VORSICHT Dieses Projekt ist ein PoC zur Reproduktion der Schwachstelle CVE-2023-30861 in Flask. Führen Sie es auf keinen Fall in einer dem Internet ausgesetzten Umgebung aus. Bei Verbindung mit einem extern erreichbaren Netzwerk kann es für reale Angriffe...

CVE-2025-65681

CVE-2025-65681 Un problema è stato scoperto in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2, che permette ad aggressori locali non autorizzati di ottenere accesso a informazioni sensibili a causa dell'assenza di intestazioni HTTP cache-control adeguate e controlli di sessione lato client...

CVE-2025-69581

CVE-2025-69581 In Chamilo LMS 1.11.2 wurde ein Problem entdeckt. Der Endpunkt /personaldata des sozialen Netzwerks legt selbst nach dem Abmelden vollständige sensible Benutzerinformationen offen, da ein ordnungsgemäßer Cache-Control fehlt. Durch die Verwendung der Zurück-Schaltfläche des Browsers...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

EUVD-2026-50887

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17961

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-64255

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

CVE-2026-61452

The Grav API plugin (getgrav/grav-plugin-api) up to version 2.0.3 has an improper session invalidation flaw: JWT access tokens are issued without a jti (JWT ID) claim and cannot be revoked server-side. Access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, passw...

CVE-2026-55423

CVE-2026-55423 affects Langflow prior to version 1.7.0, where the /logout flow fails to clear session data. Root cause: the logout endpoint did not delete cookies with matching attributes (httponly/samesite/secure/domain), so tokens persisted in local storage and cookies even after logout. Conseq...

PT-2026-51588

Name of the Vulnerable Software and Affected Versions foreman-mcp-server affected versions not specified Red Hat Satellite affected versions not specified Description A session management issue in the MCP Server allows unauthenticated attackers to hijack active administrative sessions. This occur...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

PT-2026-44425

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.363.0 Description Casdoor fails to enforce SAML assertion time bounds. The gosaml2 library calculates time-validation results, such as NotOnOrAfter and NotBefore, and reports them in the assertionInfo.WarningInfo...

EUVD-2026-31851

e107 is a content management system CMS. Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how sessionhandler::check handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates...