5030 matches found
WCE
wce Wce is a powerful Hash injection tool. It can not only be used for Hash injection, but also directly retrieve plaintext or Hash. This tool is available in 32-bit and 64-bit versions. help Parameter description: l 列出登录的会话和NTLM凭据（默认值）； s 修改当前登录会话的NTLM凭据 参数：:::； r...
CVE-2026-112769
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...
CVE-2026-109437
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...
CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...
EUVD-2026-104575
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...
CVE-2026-112769
Parse Server versions prior to 8.6.98 and 9.0.0 before 9.10.3-alpha.1 are vulnerable to a Session Class-Level Permission Bypass . The application fails to enforce create and addField class-level permissions for the _Session class. Consequently, an authenticated user, or an attacker possessing the...
CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...
EUVD-2026-104570
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...
PT-2026-117620
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.98 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description Insufficient enforcement of class-level permissions for the Session class occurs during session creation. An authenticated user or an entity...
Kage
Kage Kage ka-geh is a tool inspired by AhMyth designed for Metasploit RPC Server to interact with meterpreter sessions and generate payloads. For now it only supports windows/meterpreter & android/meterpreter. Getting Started Please follow these instructions to get a copy of Kage running on your...
CVE-2020-9470
What's this Wing FTP Server 6.2.5 - Privilege Escalation Introduction A weakness in the handling of HTTP sessions within Wing FTP Server allows any local user to escalate privileges to root on Linux, MacOS, and Solaris. Exploitation is contingent on an already-established administrative session. ...
ssh-mitm
SSH MITM v2.3-dev Author: Joe Testa @therealjoetesta Overview This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and...
Exploit for CVE-2026-111823
CVE-2026-111823 — Mage AI OAuth authentication bypass !PoCb...
CVE-2026-107648
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
CVE-2026-107648
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5 . The root cause is insufficient input sanitization and output escaping within several parameters, including action, function, plugin, p...
CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
EUVD-2026-102843
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by caussao in WordPress Plugin WP Sessions Time Monitoring Full Automatic versions = 1.1.5...
PT-2026-115582
Name of the Vulnerable Software and Affected Versions WP Sessions Time Monitoring Full Automatic versions prior to 1.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts...