CVE-2023-23752

CVE-2023-23752 О программе Этот эксплойт представляет собой обход аутентификации, который раскрывает имя пользователя и пароль администратора, а также конфигурацию MySQL: имя пользователя, пароль, хост и базу данных Уязвимые версии только 4.00 = 4.28 Использование root@kitploit: usage: exploit.sh...

zyxel-social-login-bypass-cve-2026-8508

CVE-2026-8508: 브라우저가 제출한 Facebook ID를 신뢰하여 발생하는 Zyxel Captive-Portal 우회 이 저장소는 CVE-2026-8508에 대한 공개 분석 문서writeup, 빠른 검증 스크립트, 그리고 선별된 지원 아티팩트를 패키징합니다. 개요 CVE-2026-8508은 Zyxel captive-portal 소셜 로그인의 인증 전pre-authentication 신뢰 경계trust-boundary 결함입니다. 여기의 로컬 리버스 작업은 WAX650S V7.10ABRM.4C0에 기반을 두었습니다:...

CVE-2018-10933

CVE-2018-10933 Уязвимость была найдена в серверной части конечного автомата libssh до версий 0.7.6 и 0.8.4. Злонамеренный клиент может создавать каналы без предварительной аутентификации, что приводит к несанкционированному доступу. НЕКОТОРЫЕ ПОДРОБНОСТИ Проблема связана с тем, что libssh не...

CVE-2020-1472

CVE-2020-1472 Код проверки и эксплуатации для CVE-2020-1472, также известного как Zerologon Проверяет, уязвим ли контроллер домена для атаки Zerologon. Если уязвим, сбрасывает пароль учетной записи контроллера домена в пустую строку. ПРИМЕЧАНИЕ: Скорее всего, это нарушит работу в производственных...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client 관리자 계정 탈취 WordPress Multisite에서 인증되지 않은 관리자 계정 탈취 📋 개요 WordPress용 InfiniteWP Client 플러그인 1.13.6은 Multisite 설치 에 영향을 미치는 심각한 인증 우회 취약점을 포함하고 있습니다. 인증되지 않은 공격자는 다음을 수행할 수 있습니다: 🔓 모든 인증 검사 우회 🔑 자신의 암호화 키 바인딩 👑 관리자 세션 탈취 💻 원격 코드 실행RCE 달성 🌐 전체 WordPress 네트워크 손상 🔍 근...

ncentral-compromise-ioc-triage

N-central Compromise IoC Triage Read-only defensive hunting toolkit for post-exploitation artifacts associated with N-able N-central authentication bypass vulnerabilities CVE-2026-18556 and CVE-2026-18577. The PowerShell endpoint scanner flags indicators published by N-able and Huntress; it never...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

CVE-2026-15980

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980

The MyHome Core WordPress plugin (all versions ≤ 4.4.5) contains an Authentication Bypass caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. Unauthenticated attackers can generate an activation token for an unconfirmed user ac...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

Linux Distros Unpatched Vulnerability : CVE-2026-82466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other accoun...

PT-2026-83520

Name of the Vulnerable Software and Affected Versions MyHome Core versions prior to 4.4.6 Description An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the send link AJAX handler and improper token validation within the activate...

Linux Distros Unpatched Vulnerability : CVE-2026-82469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh toke...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

CVE-2026-9090-poc

CVE-2026-9090 — Bypass della firma SAML di Casdoor PoC Proof-of-concept per CVE-2026-9090 CWE-347, Verifica impropria della firma crittografica, un bypass dell'autenticazione nella piattaforma di identità Casdoor. Attribuzione. CVE-2026-9090 è stato pubblicato e coordinato da CERT/CC — vedi...

cve-2021-21994_POC

CVE-2021-21994 — Bypass dell'autenticazione SFCB in VMware ESXi — Kit di ricerca per laboratorio...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard versioni precedenti 2.10.1 presentano una vulnerabilità di sicurezza relativa all'accesso non autorizzato. La Manager API utilizza due framework e introduce il framework droplet sulla base del framework gin; tutte le API e i middleware di...

CVE-2022-46169

CVE-2022-46169 Exploit per CVE-2022-46169 versioni di Cacti precedenti alla 1.2.3 Qui remoteclientauthorized controlla il nome host del client nella tabella poller per l'accesso root@kitploit: function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname =...

CVE-2020-14882-14883

CVE-2020-14882&14883 Weblogic ist ein von Oracle entwickelter J2EE-Anwendungsserver. CVE-2020-14882 ist eine Schwachstelle für nicht autorisierten Zugriff auf die Console; der Schweregrad der Schwachstelle wird als kritisch eingestuft, mit einer Bewertung von 9.8. CVE-2020-14883 ermöglicht unter...