tag
Session-Hijack
WeGIA Authenticated Error-Based SQL Injection Exploitation Helper (CVE-2026-23723)
WeGIA's control.php endpoint (AtendidoocorrenciaControle::listarTodosComAnexo) is vulnerable to authenticated error-based SQL injection through the idmemorando parameter. This helper script automates the tedious part of exploitation: it attempts login against…
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
TypiCMS Core allows users with file-upload permission to upload SVG files, validating only the MIME type without sanitizing the SVG's internal content. Because SVG is an XML-based format that can embed <script> tags, an attacker can upload a malicious SVG…
Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)
Saleor allowed authenticated staff users or Apps to upload arbitrary file types through its media-upload functionality, including HTML and SVG files containing embedded JavaScript. In deployments where uploaded media is served from the same origin as the…
Realtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)
The realtime-collaboration-platform project configured its Appwrite backend to allow arbitrary cross-origin requests while also enabling Access-Control-Allow-Credentials: true. Because the origin allow-list was effectively unrestricted, an attacker-controlled…
OpenCode Unauthenticated Local HTTP Server -> Remote Code Execution (CVE-2026-22812)
OpenCode versions before 1.0.216 automatically start a local HTTP server that accepts session-creation and shell-execution requests without any authentication, and does so with permissive CORS behavior. This means any local process, malicious browser tab, or…
JupyterHub Cross-Origin Form POST XSRF Bypass (CVE-2026-40864)
JupyterHub's XSRF protection, reworked in 4.1.0, uses the browser-supplied Sec-Fetch-Mode header as an origin oracle to decide whether a request is same-origin and therefore exempt from token validation. The implementation incorrectly treats Sec-Fetch-Mode:…
AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950
The AutoGPT Platform's chat-session API exposes a PATCH /sessions/{sessionid}/assign-user route that lets an authenticated user attach their own account to a chat session record, but the route performs no check that the caller currently owns the session being…
Citrix NetScaler CitrixBleed 2 Session Token Disclosure (CVE-2025-5777)
CVE-2025-5777 ("CitrixBleed 2") is an unauthenticated out-of-bounds memory disclosure in Citrix NetScaler ADC/Gateway authentication processing. A crafted request can leak chunks of process memory that may contain active session tokens and credentials.…