CVE-2022-25012

CVE-2022-25012 Argus Surveillance DVR v4.0 employs weak password encryption. Compilation gcc pocland.c -o pocland Usage Example ./pocland B4A1ECB4F539C48C7357F641C9C49083 References CVE-2022-25012 More PoCs available at: pocland...

CVE-2026-30655

CVE-2026-30655 — SQL Injection in esiclivre password reset Summary A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information...

CVE-2026-93453

CVE-2026-93453 — SOGo Password Reset Link Poisoning via Origin Header An exploit for a flaw where SOGo assembles the password-reset link it emails to users straight from the client-supplied Origin header. An anonymous attacker who knows a victim's login POSTs a recovery request with a controlled...

CVE-2026-107829

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2025-71428

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Unauthenticated Arbitrary Password Reset CVE-2025-15030 User Profile Builder — Unauthenticated Password Reset → Admin Takeover + Shell Upload / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / | / /| \ | || | / | / || / | | | // | /\/...

CVE-2026-107829

Jivejdon versions through 5.0 are vulnerable to a weak password storage issue. The application uses ToolsUtil.hash() in AccountDaoSql to store account passwords as unsalted MD5 digests . If an attacker gains access to the user table via database access or SQL injection , they can crack the passwo...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2025-71428

Versions of Jivejdon through 5.0 are vulnerable to a SQL injection flaw in the AccountDaoSql.getAccountByNameLike() method. Authenticated users with the Admin role can exploit this by submitting crafted input to the /admin/user/userListAction endpoint via the username parameter . Successful explo...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

cisco-SNMP-enumeration

Cisc0wn - Cisco SNMP Script Cisco SNMP enumeration, brute force, config downloader and password cracking script. Tested and designed to work against Cisco IOS Switches and Routers. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniel Compton, daniel dot compton ...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Token Leak & Password Reset An automated exploit script for Rocket.Chat and Meteor-based applications that leverages a NoSQL Injection via the $where clause to leak password reset tokens through server-side exceptions. Once the token is leaked, the script performs an...

EIPP

EIPP Banned Password Lists Tools for manipulating Banned Password Lists BPL of Entra ID Password Protection. The eipp-global-bpl.txt containing the entries of the global banned password list was dumped on 2024-04-11. More info at...

captaincredz

CaptainCredz TL;DR CaptainCredz is a modular and discreet password-spraying tool, with advanced features such as a cache mechanism and a fine-grained timing control. To start using captaincredz, the following lines may be useful: TEXTEDITOR=nano git clone https://github.com/synacktiv/captaincredz...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

CVE-2023-32243-Detection-and-Mitigation-in-WordPress

🔐 CVE-2023-32243 – Detection and Mitigation in WordPress 📘 Project Title: Detection and Mitigation of CVE-2023-32243 in the Essential Addons for Elementor WordPress Plugin 🧠 Abstract This project explores the exploitation and prevention of CVE-2023-32243 , a critical privilege escalation...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Password Reset Account Takeover ATO For research and testing purposes only! I am not responsible for any damages to live infrastructure if this tool is not used as intended. Only use on systems you own or have permission to be testing! Usage usage: CVE-2025-58434-PasswordResetNew.py -h -u...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...