204161 matches found
CVE-2026-5050-Blind-LDAP-Injection-via-Unescaped-Filter
CVE-2026-5050 – Blind LDAP Injection via Unescaped Filter Program Code Python with ldap3 simulation ldapserversim.py - Simulated LDAP authentication server from flask import Flask, request, jsonify app = Flaskname Fake user database USERS = 'admin': 'password': 'secret', 'role': 'admin', 'user':...
CVE-2022-25226
ThinVNC 1.0b1 - Authentication Bypass to Remote Code Execution CVE-2022-25226 Author: krill-x7 Reference: https://fluidattacks.com/advisories/sinatra Overview ThinVNC 1.0b1 contains an authentication bypass vulnerability CVE-2022-25226 allowing remote attackers to interact with the backend...
tiandy-research
tiandy-research This repository contains the results of my August 2020 research of Tiandy's IPC/NVR firmware these devices are also sold as OMNY. This "research" was not exhaustive, but I did find multiple methods to recover the administrator password remotely, enable telnet and change the root...
hashes
Magic hashes – PHP hash "collisions" Register with password 1 and then sign in with password 2. If you're in then the storage uses specified algorithm to hash the password and PHP uses == to compare them for MD5, SHA-1, and plaintext. MD5, SHA-1, SHA-224, SHA-256 and others For MD5 , SHA-1 and...
CVE-2025-8359
CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Exploit Script: CVE-2025-8359.py 📋 Description CVE: CVE-2025-8359 Vulnerability Type: Authentication Bypass Affected Product: AdForest - Classified Ads WordPress Theme Affected Versions: Up to and including 6.0.9 CVSS Score: 9.8 Critical The...
CVE-2026-45451
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...
PoC
PoC misc PoC - Internet of InSecurity Things Well worth to read about these crappy insecurity things: https://ipvm.com/reports/security-exploits Hikvision CVE-2021-36260 2021-10-19 All credit to WatchfulIP https://watchfulip.github.io/ https://github.com/mcw0/PoC/blob/master/CVE-2021-36260.py Dah...
CVE-2026-100351
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
POC-CVE-2018-10933
POC-CVE-2018-10933 LibSSH Authentication Bypass Exploit using RCE References of code Git Repo of https://www.youtube.com/watch?v=ZSWQjmfcn4g example More information about the vulnerability https://www.libssh.org/security/advisories/CVE-2018-10933.txt https://vulners.com/cve/CVE-2018-10933...
CentOS-Control-Web-Panel-CVE
CentOS Control Web Panel version 0.9.8.836 - 0.9.8.847 On June 29, 2019 our team started to find vulnerability on CentOS Control Web Panel CWP version 0.9.8.836, and we found some critical vulnerabilites. Some of the vulnerabilities we found can be chained to compromise the server from anonymous...
CVE-2019-9653
CVE-2019-9653 Date Disclosure: 03/11/2019 Last updated: 03/15/2019 Summary NUUO Inc. is a company providing a video-centric surveillance solution. They have many NVR Network Video Recorder products for different customers with various requirements. These NVRs are Linux embedded video recording...
CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient
CVE-2024-40586 Windows Coerced Authentication in FortiClient On Windows system, it was found that FortiClient App version 7.0.8.0427 allow a remote unprivileged user to coerce Windows hosts authenticate to other machines via a named pipe responsible for FortiSSLVPNdaemon service. It was observed...
CVE-2022-36537
CVE-2022-36537 Summary R1Soft Server Backup Manager uses the ZK framework as the main framework. Its security requires all Web3 project parties to pay more attention to the security vulnerabilities of various Web3 infrastructures and patch them in time to avoid potential security risks and digita...
ipmitest
ipmitest Shell script for testing the IPMI cipher type zero authentication bypass vulnerability CVE-2013-4784 The IPMI is a standardized computer system interface used by system administrators for out-of-band management of computer systems and monitoring of their operation. It is a way to manage ...
openssl: AES-OCB IV Ignored on EVP_Cipher() Path
A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...
CVE-2020-28148
CVE-2020-28148 A common way to attack WIFI, not only applicable to Xinrui a subsidiary of Sangfor WIFI products. Through multiple offensive and defensive engagements, it has been found that this exploitation method can bypass multiple AC vendors. This article is intended to disclose the...
CVE-2021-45232
Apache APISIX Dashboard Unauthorized Access Vulnerability CVE-2021-45232 FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export Remediation Suggestions Upgrade to the latest security version Apache APISIX Dashboard 2.10.1:...
CVE-2026-63030
WP2Shell — CVE-2026-63030 + CVE-2026-60137 WordPress Core Pre-Authentication RCE mass exploit / detector 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-63030 + CVE-2026-60137 Chain| wp2shell — pre-auth RCE Severity| 🔴 CRITICAL CVSS 9.8 Target| WordPress Core without plugins...
RCity-CVE-2024-27198
RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...