The vulnerability of the Enlogic SCADA system “ENTEK” virtual controller, related to the use of a password hash instead of a password for authentication, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to the use of a password hash instead of a password for authentication. Exploiting this vulnerability allows an intruder to compromise the confidentiality, integrity, and accessibility of the protected informati...

Blitz Identity Provider (Authentication server)

...

CVE-2026-7767

GitLab CE/EE versions 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to an Open Redirect in the Kubernetes proxy . Due to improper redirect validation , an authenticated user controlling a Kubernetes agent could cause sensitive authentication tokens to be sent to a...

CVE-2024-46507

The script was tested and built on Ubuntu Server 20.04 LTS, while Kali Linux was used for exploitation and walkthrough. This walkthrough guides you through exploiting the vulnerable server containing CVE-2024-46507 command injection and CVE-2024-46508 authentication bypass vulnerabilities. Initia...

CVE-2025-55182

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2019-25137-Version-Research

CVE-2019-25137 Affected Version Research CVE-2019-25137 Overview CVE-2019-25137 is a XSLT injection vulnerability in Umbraco CMS. The vulnerability is present in the XSLT Extensive Stylesheet Language Transformations Visualizer webpage. The vulnerable URI for this webpage is...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...

web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install python3 -m pip install -r requirements.txt ⏩ Usage $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /| /|| / / / /...

CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

CVE-2026-87689

The Metasploit Framework Web Service REST API (msf-ws) contains a critical authentication bypass in the Msf::WebServices::CredentialServlet component. Specifically, the update_credential (PUT) and delete_credentials (DELETE) handlers for the /api/v1/credentials route omit the mandatory warden.aut...

CVE-2025-3102

CVE-2025-3102 The SureTriggers WordPress plugin contains a critical authentication bypass vulnerability CVE-2025-3102 that affects all versions up to and including 1.0.78...

vault-conductor

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...

legion

Legion ZK Auth 🛡️ True Zero-Knowledge Authentication with Hardware-Bound Device Ring Signatures 🎯 What is Legion? Legion is a passwordless zero-knowledge authentication system that proves you're authorized without revealing who you are. Authenticate using only your fingerprint + 24-word recovery...

better-auth

Discord · Website · Issues Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a...

Hikvision-CVE-2017-7921-decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

SAP_EEM_CVE-2020-6207

PoC for CVE-2020-6207 Missing Authentication Check in SAP Solution Manager This script allows to check and exploit missing authentication checks in SAP EEM servlet tcsmdagentapplicationeem that lead to RCE on SAP SMDAgents connected to SAP Solution Manager Original finding: Pablo Artuso Yvan 'igg...

nextjs-middleware-exploit

Next.js Middleware Vulnerability Research CVE-2025-29927 This repository demonstrates a critical vulnerability in Next.js middleware CVE-2025-29927, which affects versions 11.1.4 through 15.1.7. This vulnerability allows for authorization bypass , CSP bypass , and potential DoS attacks through...

cve-2022-23131

cve-2022-23131 Usage: python3 zabbix.py target Admin target is the target address Admin is fixed as the administrator username Replace the generated zbxsignedsession with the cookie of the current target Click "Sign in with Single Sign-On SAML" on the login page to directly enter the management...

CVE-2018-10933

CVE-2018-10933 CVE-2018-10933 sshlib user authentication attack - docker lab, test and exploit...

CrushFTP-CVE-2024-4040-illdeed

CVE-2024-4040 — CrushFTP Authentication Bypass Exploit This repository contains a stealthy Python proof-of-concept PoC exploit for CVE-2024-4040 , a critical vulnerability in CrushFTP v10 and below that allows an attacker to bypass authentication using a forged CrushAuth cookie and AWS-style...