CVE-2025-24813-PoC-Apache-Tomcat-RCE

Apache Tomcat CVE-2025-24813 Proof of Concept PoC A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability CVE-2025-24813. This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management. WARNING : This tool is for authorized securi...

ssh3

!NOTE SSH3 is probably going to change its name. It is still the SSH Connection Protocol RFC4254 running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification dra...

TeleKiller

. / \ |U| \ / \ \ \ | \ /\ |L| \ \ \ | /| | / | \ / / |T| | | | /| | | | | | | | | / / |R| | | | | | | | | | | | | | | |A| | | | | | | | | | | | | | \ \ |S| | | | | | | \ | | | /| /| /\ | / \ \ |E| | /| /| /| \ \ /// |/ / |C| ///|/ / '--8--' 8 O TeleKiller A Tools Session Hijacking And...

CVE-2019-11043

CVE-2019-11043 Python exp for CVE-2019-11043 You can use build environment from https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043 Usage： python3 main.py -u http://iptopage/index.php If you success, you will see: Base status code is 200 qsl:1760 with status code 502 The target maybe...

CVE-2026-63157

The Omnispace Agora Project versions prior to 26.10.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability in the Links module . The root cause is the failure to neutralize quotes when echoing an unsanitized link address (adress) field into an onclick event-handler attribute. An aut...

CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...

CVE-2026-63161

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a session fixation vulnerability (CWE-384). This flaw occurs because the application fails to regenerate the session identifier upon successful authentication. A remote attacker can exploit this by planting a known session i...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-CSRF-On-Web-SSH Repository contains description for CVE-2023-35793 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35793 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Cross Site Request Forgery...

CVE-2026-83662

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker could exploit this issue to inject malicious scripts into a web page, potentially leading to elevated access or control over the victim's account or session . Successful exploitatio...

CVE-2026-106630

Adobe Experience Manager is impacted by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by injecting malicious scripts into vulnerable form fields . When a victim visits a page containing these fields, the malicious JavaScript may execute in their browser,...

CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20)

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require use...

CVE-2026-92922

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerab...

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000-LiteSpeed-Cache CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. Preview How to use ? git clone...

CVE-2026-83701

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to achieve local privilege escalation . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is indicated as an OFFI...

CVE-2026-83700

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to perform a local elevation of privilege . No specific exploit details or remediation steps are provided in the documents.

CVE-2022-23131

CVE-2022-23131 Zabbix - SAML SSO Authentication Bypass Description In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor, because a user login stored in the session was not verified. Dork: shodan-query:...

CVE-2018-18925

CVE-2018-18925 Exploitation of CVE-2018-18925 a Remote Code Execution against the Git self hosted tool: Gogs. Gogs is based on the Macaron framework. The system used to manage session is very similar to what PHP does. The session identifier in the cookie is mapped to a file on the file system. Wh...

padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

cve-2025-5755

CVE-2025-5777: The Ultimate PoC & Scanner 🚀 An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 CitrixBleed 2. This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory...