CVE-2024-50477

CVE-2024-50477 Stacks Mobile App Builder = 5.2.3 - Bypass di autenticazione tramite Account Takeover Descrizione: Il plugin Stacks Mobile App Builder – il più potente plugin drag and drop per la creazione di applicazioni mobili per WordPress è vulnerabile a un bypass di autenticazione in tutte le...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-82456

argocd-mcp version 0.8.0 (argoproj-labs) has an authentication bypass via its unauthenticated HTTP transport. The server binds to all network interfaces and accepts MCP sessions without requiring caller credentials when the ARGOCD_API_TOKEN environment variable is configured. Any network-reachabl...

CVE-2026-82454

CVE-2026-82454 is a CRITICAL authentication bypass in the Omnivore API (packages/api), affecting versions before android-0.227.0 . The decodeAppleToken function extracted the alg field from an attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Because jsonwe...

CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

EUVD-2026-68109

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

EUVD-2026-68107

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452

rust-iot-platform (through commit 5df942ab) contains an authentication bypass caused by most REST API routes lacking authentication guards in their handler signatures, as seen in the user router. An unauthenticated attacker over the network with low complexity can create, update, list, retrieve, ...

CVE-2024-4040

CVE-2024-4040 PoC Exploit Python per CVE-2024-4040 Descrizione Una vulnerabilità di server side template injection in CrushFTP in tutte le versioni precedenti alla 10.7.1 e 11.1.0 su tutte le piattaforme consente ad attaccanti remoti non autenticati di leggere file dal filesystem al di fuori del...

CVE-2023-52268

Exploração de Bypass de Autenticação do Portal do Usuário Final do FreeScout CVE-2023-52268 Visão Geral Este exploit visa uma vulnerabilidade no Módulo do Portal do Usuário Final do FreeScout versões anteriores a 1.0.65 que permite que um invasor contorne a autenticação através do gerenciamento...

CVE-2020-1472

Script di test per ZeroLogon Uno script Python che utilizza la libreria Impacket per testare la vulnerabilità relativa allo sfruttamento di Zerologon CVE-2020-1472. Tenta di eseguire il bypass dell'autenticazione Netlogon. Lo script terminerà immediatamente quando il bypass viene eseguito con...

CVE-2024-55591

FortiGate CVE-2024-55591 1Scan neueste Version https://github.com/0x7556/1Scan Betroffene Versionen root@kitploit: FortiOS 7.0.0 bis 7.0.16 FortiProxy 7.0.0 bis 7.0.19 FortiProxy 7.2.0 bis 7.2.12 POC Einzelprüfung root@kitploit: ./poc 10.10.1.1 ./poc http://10.10.1.1 1Scan Batch root@kitploit:...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

CVE-2025-64516-POC

CVE-2025-64516 दस्तावेज़ों तक अनधिकृत पहुंच के लिए POC। CVE-2025-64516 प्रभाव एक अप्रमाणित उपयोगकर्ता किसी भी आइटम टिकट, संपत्ति, ... से जुड़े GLPI दस्तावेज़ों तक पहुंच सकता है। प्रभावित संस्करण संस्करण = 10.0.0, = 11.0.0 पैच 10.0.21 पर अपग्रेड करें 11.0.3 पर अपग्रेड करें उपयोग root@kitploit: git...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - Vulnerabilità di bypass dell'autenticazione tramite SQL Injection nel sistema del portale online degli ingegneri. Descrizione tecnica: Una vulnerabilità di SQL Injection esiste nel modulo di login del Portale Online degli Ingegneri che può permettere a un attaccant...

Craftcms-PoC-CVE-2026-31266

CVE-2026-31266 - Craft CMS Autorizzazione Mancante Informazioni CVE Campo| Valore ---|--- CVE ID| CVE-2026-31266 Fornitore| Pixel & Tonic Prodotto| Craft CMS Versioni Affette| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; Proof of Concept root@kitploit: With allowAdminChanges=false cu...

CVE-2024-27198_LAB

Laboratorio CVE-2024-27198 Descrizione TeamCity fornisce una pagina riservata agli amministratori per la gestione dei token che non è protetta da autenticazione. Ciò consente a un utente non autenticato di generare un token di accesso per l'utente amministratore se riesce a trovare l'ID di un...