CVE-2014-0195

XML-RPC WordPress 暴力破解利用脚本 该仓库包含一个基于Python的概念验证（PoC）脚本，用于对存在CVE-2014-0195漏洞的WordPress实例进行登录凭据暴力破解。该漏洞利用XML-RPC的system.multicall函数，可以在单个HTTP请求中尝试多次登录请求，可能导致拒绝服务。此脚本旨在供网络安全专业人员评估WordPress安装的安全性。 免责声明 此代码仅供在授权系统上合法使用。未经授权使用此代码属违法行为，可能导致严重后果。在测试或利用不属于您的系统之前，始终获取明确许可。 漏洞概述 漏洞存在于WordPress的XML-RPC...

CVE-2025-10035

CVE-2025-10035 此检测方法的工作原理是什么？ 通过从登录页面提取版本号，并与受影响版本范围进行匹配，检测存在漏洞的 GoAnywhere MFT 实例。 如何运行此脚本？ 1. 从此处下载 Nuclei 2. 将模板复制到本地系统 3. 运行以下命令：nuclei -u https://yourHost.com -t template.yaml 示例输出 参考资料 https://www.fortra.com/security/advisories/product-security/fi-2025-012...

EUVD-2026-92816

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

PT-2026-106712

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The atta...

PT-2026-106493

Unauthenticated Bypass Vulnerability in Login Lockdown = 2.17 versions...

PT-2026-106719

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...

PT-2026-106459

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions...

PT-2026-107133

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process...

PT-2026-107134

Insufficient validation in the Single Sign-On SSO login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider IdP to deliver authentication material to an attacker-controlled URL instead of to CloudVision...

PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106359

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

PT-2026-106317

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

Security Advisory 0187

Security Advisory 0187 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All CVEs covered in this advisory affect CloudVision Portal On-Premises, where specially crafted requests could result in user redirection to arbitrary...

CVE-2024-23733

CVE-2024-23733 Software AG webMethods API Integration Server 10.15.0 访问控制不当 描述 Software AG webMethods 10.15.0（CoreFix7 之前版本）Integration Server 中的 /WmAdmin/,/invoke/vm.server/login 登录页面允许远程攻击者通过向 /WmAdmin//login/ URI 发送任意用户名和空密码，从而访问管理面板并发现主机名和版本信息。 漏洞类型 访问控制不当 产品厂商 SoftwareAG...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 Online-Food-Ordering-Web-App 中的 SQL 注入漏洞 Online-Food-Ordering-Web-App 存在未经验证的错误型和时间型盲 SQL 注入攻击漏洞。 /login.php 页面上的 username 参数未对用户输入进行清理，攻击者可以使用简单的绕过技术绕过登录。 应用链接 Online-Food-Ordering-Web-App 受影响的组件与参数 URL: /login.php 参数: username POC 登录绕过 PAYLOAD 要绕过用户登录并获得完全的管理员访问权限，...

CVE-2023-38890

CVE-2023-38890 描述 Online Shopping Portal Project V3.1 允许远程攻击者通过登录表单执行任意 SQL 命令/查询，导致未授权访问和潜在的数据篡改。该漏洞源于对用户提供的用户名字段输入验证不足，从而引发 SQL 注入攻击。 漏洞利用标题： Online Shopping Portal Project V3.1 PHPgurukul - Time-Based Blind Sqli 漏洞利用作者： Akshad Joshi 厂商主页： https://phpgurukul.com 软件链接：...

CVE-2026-105468

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

CVE-2026-105468

The girishsaraf Online-Appointment-Booking-System is vulnerable to a SQL injection flaw within the Login Handler component, specifically affecting the mysqli_query function in the Admin/mlogin.php file. An attacker can initiate a remote attack by manipulating the uname or pass arguments. While th...

CVE-2026-105468 girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

CVE-2026-105468 girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...