87169 matches found
CVE-2026-108108
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chapverify returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP wit...
CVE-2026-107804
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowli...
CVE-2026-107808
The Nginx UI web user interface (versions 2.0.0 to 2.5.0 ) is vulnerable to an authentication bypass due to improper 2FA enforcement. Specifically, the POST /api/login endpoint fails to require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured, even if EnabledOTP i...
TwoMillion-Machine-Writeup
About Machine TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code. After hacking the invite code an account can be created on the...
abdal-lockbox
🔐 Abdal LockBox 🌐 Read in your language: 🇬🇧 English | 🇨🇳 中文 | 🇷🇺 Русский | 🇪🇸 Español | 🇯🇵 日本語 | 🇮🇷 فارسی | 🇸🇦 العربية | 🇹🇷 Türkçe | 🇩🇪 Deutsch | 🇮🇳 हिन्दी Secure. Store. Autofill. — A privacy-first Android password manager by Abdal Security Group. Abdal LockBox keeps your credentials encrypted on...
EUVD-2026-95809
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chapverify returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP wit...
CVE-2026-108108
PHPNuxBill versions up to 2025.3.20 are vulnerable to an authentication bypass in RADIUS CHAP verification. The root cause is located in the Password::chap_verify() function, which incorrectly returns true even when the supplied response does not match the expected value. This allows an attacker ...
CVE-2026-108108 PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chapverify returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP wit...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...
CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...
KeePass-CVE-2023-32784-Exploitation-and-Defense
KeePass Memory Leak Vulnerability CVE-2023-32784:Exploitation & Defense Architecture Objective To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe v2.53, demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls. The...
CVE-2026-106601
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2...
CVE-2026-106602
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2...
ResetNightmare-impacket
ResetNightmare — CVE-2026-27912 Linux / impacket tooling for CVE-2026-27912 "ResetNightmare". Resets a target Active Directory account's password by requesting a kadmin/changepw TGT for an NTENTERPRISE principal whose name is the target's sAMAccountName, using an account UPNUser on which we can...
CVE-2025-59382-QNAP-Password-Reset-Account-Takeover
CVE-2025-59382: QNAP Password Reset to Account Takeover Unauthenticated attacker-controlled password reset URL in /cgi-bin/resetpassword.cgi. Tested against QuTScloud c5.2.4.3041 build 20250211 in a lab. QNAP later published this as CVE-2025-59382 in advisory QSA-26-10. Short version An...
CVE-2026-64638-PoC-Exploit
CVE‑2026‑64638 – WordPress XSS2Shell Security Suite ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act...
CVE-2026-106602
The WordPress Jetpack plugin (versions
CVE-2026-106602 WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2...
CVE-2026-106601 WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2...