CVE-2025-51586-PrestaShop-PoC

CVE-2025-51586 - PrestaShop AdminLogin Preuve de concept d'énumération d'e-mails 📌 Vue d'ensemble Ce dépôt contient une preuve de concept PoC éthique pour la vulnérabilité CVE-2025-51586, affectant PrestaShop versions 1.7.x — 8.2.2. La PoC énumère les adresses e-mail des administrateurs via le...

CVE-2025-22381

CVE-2025-22381 : Injection d'en-tête Host dans Aggie Analyse détaillée et Preuve de Concept pour CVE-2025-22381, une vulnérabilité d'injection d'en-tête Host découverte dans le projet open-source Aggie. Aperçu de la vulnérabilité+ ID CVE : CVE-2025-22381 Publié : Octobre 2025 attribution MITRE...

CVE-2025-50422

Poppler avant la version 25.04.0 Lorsque pdftocairo rend un PDF malveillant et appelle cairodebugresetstaticdata à la sortie, la mémoire heap contenant les flux d'objets PDF n'est pas correctement effacée. Un attaquant ayant un accès local peut vider la mémoire du processus et récupérer le conten...

MadeYouReset_Tester

Vérificateur MadeYouReset Un script Python léger pour détecter si un serveur web est potentiellement vulnérable à la vulnérabilité de déni de service HTTP/2 MadeYouReset — suivie sous la référence CVE-2025-8671 CVSS 7.5 High. Contexte MadeYouReset est une vulnérabilité DoS HTTP/2 divulguée en aoû...

KeySniper

KeySniper Автор: Mitsec — x.com/ynsmroztas CVE-2026-18963 — неаутентифицированный захват учётной записи Keycloak через поток сброса учётных данных. KeySniper — это ориентированный на продакшн сканер для баг-баунти в рамках программы и авторизованных оценок: живой радарный вывод, обнаружение realm...

CVE-2022-41741-742-Nginx-Vulnerability-Scanner

🛡️ Scanner de vulnérabilités Nginx Développé par m10sec. Ce script détecte automatiquement la version de Nginx sur un serveur distant et évalue s'il est vulnérable à des failles de sécurité connues, spécifiquement : CVE-2023-44487 – HTTP/2 Rapid Reset Attack CVE-2022-41741 – Corruption mémoire dan...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — обход reset-credentials в Keycloak - захват учётной записи Account Takeover...

GitLab-CVE-2023-7028

GitLab CVE-2023-7028 — Mock 16.6.0 только хост CVE-2023-7028 CVSS 10.0: POST /users/password принимал массив useremail — сервер находил пользователя по email0, но отправлял один и тот же токен сброса на каждый адрес → атакующий с [email protected] перехватывает [email protected]...

CVE-2026-72898-safe-detection

CVE-2026-72898-safe-detection Simple script to achieve safe and non-destructive active detection of CVE-2026-72898 SQLi in Metabase It attempts to determine if a Metabase instance is vulnerable to the SQL injection vulnerability in the password reset endpoint. The script is designed to be safe an...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

OctoberCMS - Account Takeover

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. id:...

EUVD-2026-92049

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127: Allocation of Resources Without Limits or Throttling

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127

The LaraDashboard software (versions 1.4.2 before 1.4.8 ) is vulnerable to a resource exhaustion issue within its unauthenticated forgot-password and reset-password endpoints. The root cause is the application's use of advanced email validation, which triggers external DNS lookups and paid Abstra...

PT-2026-104593

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-82043

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043

Versions of UTMStack prior to 11.2.16 are vulnerable to an account enumeration flaw. An unauthenticated attacker can identify registered email addresses by sending requests to the POST /api/account/reset-password/init endpoint. The application provides different HTTP responses based on the existe...