773 PoCs | 119 CISA KEV

tag

Session-Hijacking

PrestaShop Checkout Zero-Click Account Takeover via ExpressCheckout Endpoint (CVE-2025-61922)

CVE-2025-61922 web Patched

CVE-2025-61922webCRITICAL 9.1Patched2026-07-06CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309) KEV EPSS 95%

CVE-2025-54309 web Patched

CVE-2025-54309webCRITICAL 9Patched2026-07-06Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)

CVE-2026-22804 (GHSA-m3cv-5hgp-hv35) web Patched

CVE-2026-22804webHIGHPatched2026-07-05Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)

CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv) web Patched

CVE-2026-22849webHIGHPatched2026-07-05OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)

CVE-2026-24415 (GHSA-jfgp-g7x7-j25j) web Patched

CVE-2026-24415webMEDIUMPatched2026-07-05NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)

CVE-2026-3228 web Unverified

CVE-2026-3228webMEDIUM 6.4Unverified2026-07-05