BreakEscape

BreakEscape Rails Engine Cybersecurity training escape room game as a mountable Rails Engine. Features 24+ cybersecurity escape room scenarios Server-side progress tracking with 2-table schema Randomized passwords per game instance via ERB JIT Ink script compilation for NPC dialogue Polymorphic...

CVE-2025-24813

利用条件 DefaultServlet 写入功能启用：需在 web.xml 中配置 readonly=false Partial PUT 请求支持：Tomcat 默认支持分块上传 文件会话持久化启用：需在 context.xml 中配置 PersistentManager 和 FileStore 存在反序列化利用链：类路径下需包含存在漏洞的库 影响范围 9.0.0.M1 readonly false 2. 需要在conf/context.xml中，开启File文件会话存储 version: '3.8' services: tomcat: image:...

burp_global_match_replace

Global Match & Replace GMR Extensión de Burp Suite Global Match & Replace GMR amplía Burp Suite con reglas de coincidencia/reemplazo que se aplican globalmente o en múltiples herramientas de tu elección Repeater, Intruder, Proxy, etc.. Proporciona diferencias diffs por solicitud y respuesta para...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

启用双因素认证后会话持久化 概述 Nagios Fusion 应用程序（版本 2024R1.2 和 2024R2）存在一个高危安全漏洞：即使在启用双因素认证（2FA）后，现有会话仍然保持有效。具体而言，当为管理员账户启用 2FA 时，应用程序未能失效所有在启用 2FA 之前建立的活跃会话。这使得能够访问旧会话的攻击者或未授权用户能够绕过 2FA 机制，执行未授权操作。 观察到以下问题： 会话持久化：启用 2FA 之前创建的会话仍然有效，无需额外的身份验证因素。 未授权权限提升：攻击者可利用这些旧会话，在无需 2FA 验证的情况下修改关键账户详情或执行管理操作。 此漏洞源于在启用 2FA...

CVE-2026-101023

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat PUT Parcial + Deserialización RCE 📋 Resumen CVE-2025-24813 es una vulnerabilidad de alta gravedad en Apache Tomcat que permite ejecución remota de código no autenticada cuando se cumplen tres condiciones: 1. El servlet predeterminado tiene habilitado el acceso de...

Tomcat-CVE-2025-24813

使用条件 DefaultServlet 写入功能已启用：需要在 web.xml 中将 readonly 配置为 false 支持部分 PUT 请求：Tomcat 默认支持分块上传 启用文件会话持久化：需要在 context.xml 中配置 PersistentManager 和 FileStore 存在反序列化利用链：类路径中必须包含存在漏洞的库 影响范围 9.0.0.M1 readonly false 2. 你需要在 conf/context.xml 中启用文件会话存储。 version: '3.8' services: tomcat: image:...

Burp-Recordadora

🧙‍♂️ Recordadora Recordadora es una extensión para BurpSuite inspirada en Harry Potter. Como la recordadora de Neville, te ayuda a no olvidar ni perder el contexto de tus pruebas. ✨ Funcionalidades Guardar y restaurar historial del Proxy Exportar e importar requests del Repeater Persistir cargas...

CVE-2026-34828

CVE-2026-34828 Persistencia de sesión de listmonk tras el restablecimiento y cambio de contraseña Introducción Encontré este problema al revisar listmonk , un gestor de boletines y listas de correo de código abierto, con una simple pregunta de seguridad en mente: Cuando un usuario cambia o...

CVE-2025-24813

说明 本仓库是针对 CVE-2025-24813 Tomcat 最新 RCE 复现的环境。 仅供学习研究使用！ 利用条件 应用程序启用了DefaultServlet写入功能，该功能默认关闭 应用支持了 partial PUT 请求，能够将恶意的序列化数据写入到会话文件中，该功能默认开启 应用使用了 Tomcat 的文件会话持久化并且使用了默认的会话存储位置，需要额外配置 应用中包含一个存在反序列化漏洞的库，比如存在于类路径下的 commons-collections，此条件取决于业务实现是否依赖存在反序列化利用链的库 本环境已开启上述复现所需条件 启动 tomcat Linux: chm...

CVE-2025-24813-POC

CVE-2025-24813: Prueba de Concepto de RCE en Apache Tomcat Este repositorio proporciona un entorno controlado y automatizado para demostrar vulnerabilidades de Ejecución Remota de Código RCE en Apache Tomcat mediante CVE-2025-24813. Descripción general Esta PoC explota la persistencia de sesiones...

java-vulnerable

Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

BIT-AIRFLOW-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

EUVD-2026-85773

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...