Session-Hijacking — PoC Archivehttps://poc.intelseclab.com/tags/session-hijacking/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000PrestaShop Checkout Zero-Click Account Takeover via ExpressCheckout Endpoint (CVE-2025-61922)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-61922-prestashop-checkout-account-takeover/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-61922-prestashop-checkout-account-takeover/Critical severity (CVSS 9.1) — web · CVE-2025-61922. Status: PoC. Affects: PrestaShop Checkout module (ps_checkout). Tags: prestashop, ps_checkout, account-takeover, express-checkout, paypal, zero-click, session-hijacking, e-commerce, cwe-287.webCriticalprestashopps_checkoutaccount-takeoverexpress-checkoutpaypalzero-clicksession-hijackinge-commercecwe-287CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54309-crushftp-as2-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54309-crushftp-as2-auth-bypass/Critical severity (CVSS 9) — web · CVE-2025-54309. Status: Patched. Affects: CrushFTP server, AS2 (Applicability Statement 2) authentication module / web admin interface. Tags: crushftp, as2, authentication-bypass, cwe-287, cwe-306, cwe-807, session-hijacking, shell, ftp-server.webCriticalcrushftpas2authentication-bypasscwe-287cwe-306cwe-807session-hijackingshellftp-serverTermix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/High severity — web · CVE-2026-22804 (GHSA-m3cv-5hgp-hv35). Status: Weaponized. Affects: Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx). Tags: termix, electron, stored-xss, svg-injection, session-hijacking, lfi, file-manager, ssh.webHightermixelectronstored-xsssvg-injectionsession-hijackinglfifile-managersshSaleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/High severity — web · CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv). Status: PoC. Affects: Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products). Tags: saleor, stored-xss, editorjs, graphql, ecommerce, session-hijacking, cwe-79.webHighsaleorstored-xsseditorjsgraphqlecommercesession-hijackingcwe-79OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24415-openstamanager-xss/Medium severity — web · CVE-2026-24415 (GHSA-jfgp-g7x7-j25j). Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: xss, reflected-xss, openstamanager, cwe-79, session-hijacking, php, unauthenticated-payload.webMediumxssreflected-xssopenstamanagercwe-79session-hijackingphpunauthenticated-payloadNextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3228-nextscripts-wp-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-3228. Status: PoC. Affects: NextScripts: Social Networks Auto-Poster (WordPress plugin). Tags: wordpress, xss, stored-xss, plugin, contributor-privilege, shortcode, session-hijacking.webMediumwordpressxssstored-xssplugincontributor-privilegeshortcodesession-hijacking