CVE-2024-41958-PoC

CVE-2024-41958-PoC 这是 CVE-2024-41958 的一个小型概念验证代码。 可以绕过管理员面板上的 TFA 认证。 受影响版本： 2024-07 该 CVE 生效所需的先决条件： 一个没有启用 TFA 的账户的密码和用户名。 一个已启用 TFA 的账户的密码和用户名。 Mailcow 版本低于 2024-07。 如何使用该 PoC： 1. 安装依赖 root@kitploit: pip install -r requirements.txt 2. 在脚本中填写必要的信息 URL 未启用 TFA 的用户的密码和用户名 启用了 TFA 的用户的密码和用户名 3. 运行...

fortinet-cve-2024-50562

Fortinet SSL-VPN 会话重用漏洞（CVE-2024-50562） 专业、仅限授权的扫描器 ，用于验证 FortiGate 在用户注销后是否作废了会话 Cookie。 阳性结果确认 CVE-2024-50562 ——一种会话过期不充分 缺陷（CWE-613），允许攻击者重放被盗取的 Cookie，甚至在用户明确注销后仍能重新登录。 官方公告: https://fortiguard.com/psirt/FG-IR-24-339 0 | 执行摘要 “FortiOS SSL-VPN 中存在一个会话过期不充分漏洞 CWE-613，攻击者若持有用于登录 SSL-VPN 门户的...

CVE-2026-41940-Detection

CVE-2026-41940 检测 针对 cPanel/WHM 身份验证绕过漏洞（CVE-2026-41940）的检测规则和日志架构，由 Unfold Security 提供。 博客文章： cPanel 漏洞利用 — CVE-2026-41940 目录结构 root@kitploit: ├── cpanelcve202641940malget.yml SIGMA 规则 — 检测 CRLF 注入请求 ├── cpanelsessionmalauthorization.yml SIGMA 规则 — 检测未经先前登录的会话使用 ├── Schemas/ │ ├── Microsoft...

CVE-2025-23419

🔐 Тестер эксплуатации повторного использования TLS-сеанса $ ОТ XIT Инструмент на Python для проверки потенциальных уязвимостей повторного использования TLS-сеанса, которые могут позволить обойти аутентификацию на неправильно настроенных серверах. ⚠️ Предупреждение Этот инструмент предназначен...

Astra Linux – Vulnerability in liblivemedia

Live555 before 2019.08.16 has a Use-After-Free issue, as GenericMediaServer::createNewClientSessionWithId can generate the same client session ID consecutively. This issue is handled improperly by the MPEG1or2 and Matroska file demultiplexors...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

BIT-NODE-MIN-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

BIT-NODE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52654

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

CVE-2026-14465 : Insufficient session expiration allowing session ID reuse (session fixation) in Bilin Software’s HUMANIST Digital Human Resources. Affects versions from 26.0 up to, but not including, 26.1. Impact: potential for session replay with high confidentiality risk; no impact to integrit...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...

SUSE CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

UBUNTU-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...