CVE-2025-24813

Exploitation Conditions DefaultServlet Write Function Enabled: Must configure readonly=false in web.xml Partial PUT Request Support: Tomcat supports chunked upload by default File Session Persistence Enabled: Must configure PersistentManager and FileStore in context.xml Deserialization Exploit...

BreakEscape

BreakEscape Rails Engine Cybersecurity training escape room game as a mountable Rails Engine. Features 24+ cybersecurity escape room scenarios Server-side progress tracking with 2-table schema Randomized passwords per game instance via ERB JIT Ink script compilation for NPC dialogue Polymorphic...

Burp-Recordadora

🧙‍♂️ Recordadora Recordadora is a BurpSuite extension inspired by Harry Potter. Like Neville's Remembrall, it helps you not to forget or lose context of your tests. ✨ Features Save and restore Proxy history Export and import Repeater requests Persist Intruder payloads Support for .log files to...

CVE-2026-34828

CVE-2026-34828 listmonk’s Session Persistence After Password Reset and Password Change Intro I found this issue while reviewing listmonk , an open-source newsletter and mailing list manager, with a simple security question in mind: When a user changes or resets a password, does the application...

CVE-2025-24813

Description This repository is an environment for reproducing the latest RCE of CVE-2025-24813 Tomcat. For learning and research purposes only! Exploitation Conditions The application has enabled the DefaultServlet write functionality, which is disabled by default. The application supports partia...

CVE-2025-24813-POC

CVE-2025-24813: Prueba de Concepto de RCE en Apache Tomcat Este repositorio proporciona un entorno controlado y automatizado para demostrar vulnerabilidades de Ejecución Remota de Código RCE en Apache Tomcat mediante CVE-2025-24813. Descripción general Esta PoC explota la persistencia de sesiones...

burp_global_match_replace

Global Match & Replace GMR Extensión de Burp Suite Global Match & Replace GMR amplía Burp Suite con reglas de coincidencia/reemplazo que se aplican globalmente o en múltiples herramientas de tu elección Repeater, Intruder, Proxy, etc.. Proporciona diferencias diffs por solicitud y respuesta para...

java-vulnerable

Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat Partial PUT + Deserialization RCE 📋 Overview CVE-2025-24813 is a high‑severity vulnerability in Apache Tomcat that allows unauthenticated remote code execution when three conditions are met: 1. The default servlet has write access enabled readonly=false. 2. Partial...

Tomcat-CVE-2025-24813

Conditions of Use DefaultServlet write function is enabled: it needs to web.xml be configured inreadonly=false Partial PUT request support: Tomcat supports block upload by default Enable file session persistence: need to context.xml configure PersistentManager and FileStore There is a...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

BIT-AIRFLOW-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

EUVD-2026-85773

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-82311

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...