CVE-2025-10294

Exploit: Authentication Bypass via Empty ownidsharedsecret JWT Forgery 1 Forge a valid JWT using an empty HMAC key SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

CVE-2025-40554

CVE-2025-40554 Exploitation Suite A comprehensive security testing tool for detecting and exploiting the authentication bypass vulnerability CVE-2025-40554 / CVE-2025-40536 in SolarWinds Web Help Desk. ⚠️ Disclaimer FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY This tool is provide...

kentico-xperience13-AuthBypass-wt-2025-0011

WT-2025-0011 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action python3 .\watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0011.py -H http://labcms -u admin / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | |...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor Context Authentication Bypass — Vulnerability Detection Script A safe, unauthenticated vulnerability check for CVE-2026-19490 , the pre-authentication authentication bypass in the Citrix NetScaler ADC / NetScaler Gateway SAML service-provider path CTX696939, publishe...

routers-exploit

OpenSource Repo with PoC's and vulns found in routers TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC CVE-2020-9374 - TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC Payload: "$ls" TP LINK TL-WR849N - Auth Bypass: Firmware and Configs update TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC...

CVE-2022-26134

CVE-2022-26134 Confluence Pre-Auth Object-Graph Navigation Language OGNL Injection Confluence is a web-based workspace collaboration product that is developed by Atlassian. It can be deployed on-prem or as part of Atlassian Cloud. It consists of 3 key features: page, space and page tree. Page: Yo...

bigip-scanner

BIG-IP Scanner Determine the running software version of a remote F5 BIG-IP management interface. Developed with ❤️ by the Bishop Fox Cosmos team. Description CVE-2022-1388, a critical vulnerability in the F5 BIG-IP management interface, allows an attacker to bypass authentication and remotely...

SecureConnect-Auth-Bypass

ConnectWise SecureConnect Authentication Bypass Vulnerability An exploit proof of concept for ConnectWise SecureConnect authentication bypass vulnerability. Blog Post More details here: https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/ Usage Running...

CVE-2023-20198-Exploit

Cisco IOS XE Authentication Bypass CVE-2023-20198 This repository contains a proof-of-concept exploit for CVE-2023-20198 , an authentication bypass vulnerability affecting Cisco IOS XE Web UI. The vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable Cisco...

cups-script-final-project

What it does Two-stage detection tool for CVE-2025-58060, authentication bypass vulnerability in the Common UNIX Printing System CUPS. Rather than relying on version numbers alone, the tool combines a banner-based version check with an active auth bypass probe. This helps confirming real...

CVE-2026-104198

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

EUVD-2026-98753

Gotify: Insufficiently Protected Password Change endpoint...

EUVD-2026-97907

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...

EUVD-2026-97864

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...

GHSA-WQ4W-VWVQ-Q3X9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

EUVD-2026-97865

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover...

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did...