Modlishka

..Modlishka.. Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a sing...

CVE-2022-28601

CVE-2022-28601 A Two-Factor Authentication 2FA bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Medium Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Two-Factor Authentication Bypass...

EvilnoVNC

EvilnoVNC EvilnoVNC is a Ready to go Phishing Platform. Unlike other phishing techniques, EvilnoVNC allows 2FA bypassing by using a real browser over a noVNC connection. In addition, this tool allows us to see in real time all of the victim's actions, access to their downloaded files and the enti...

SMSOTPBOT

ghost-OTPBOT ghost-OTPBOT is the most advanced and versatile OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank. You can use this to get OTP for logins, banks, credit cards, apple pay, and more. Join...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

wordpress-cve-2024-10924-pentest

WordPress CVE-2024-10924 Penetration Testing Report 2FA Bypass Vulnerability in Really Simple SSL Plugin 📋 Table of Contents Executive Summary Target Information Methodology Timeline Reconnaissance Phase Vulnerability Analysis Attack Flow Exploitation Impact Assessment Remediation Tools Used...

wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 Exploit 📌 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication 2FA. Attackers can exploit this flaw to log in as any user with a valid...

0-click-RCE-Exploit-for-CVE-2024-10924

CVE-2024-10924 / Auth Bypass 2FA to RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859061671852909055 This repository contains a proof-of-concept exploit for CVE-2024-10924, an authentication and 2FA bypass vulnerability in the Really Simple Security WordPress plugin tha...

CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Description : Rate limit Bypass which leads to 2FA Bypass Tested Version : 2.7.0 Attack Type: Remote Impact : 2FA Bypass Vendor of Product : https://www.discourse.org Additional Information : Discourse is discussion platform built for the next decade of the...

evilginx

Evilginx v.1.1.0 QUESTA VERSIONE È OBSOLETA. USA L'ULTIMA VERSIONE! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx è un framework per attacchi man-in-the-middle utilizzato per il phishing di credenziali e cookie di sessione di qualsiasi servizio web. Il suo core gira sul server HTTP...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function 🚨 CVE-2025-7955 | RingCentral Communications WordPress Exploit 📝 Vulnerability Overview CVE: CVE-2025-7955 Affected Plugin: RingCentral...

CVE-2024-10924

CVE-2024-10924 Exploit - WordPress Really Simple SSL Plugin 2FA Bypass Overview This repository contains an exploit for CVE-2024-10924 , a vulnerability in the Really Simple SSL plugin for WordPress. It allows an attacker to bypass Two-Factor Authentication 2FA onboarding and gain unauthorized...

Mind-Maps

MindMaps 🗺️ This repository stores and houses various Mindmaps for bug bounty Hunters🧑‍🦰, pentesters🧑‍🦰 and offensive🔴/defensive🔵 security Professionals🫂 provided by me as well as contributed by the community🧑🏻‍🤝‍🧑🏽. Your contributions and suggestions are welcomed. Name| Link| Type| Description|...

research

Research — Bertoldi Cybersecurity Published security research by Alessandro Bertoldi and collaborators. Papers Title| Event| Year| Link ---|---|---|--- Infinity-Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ Domains| DeepSec Vienna 2025| 2025| PDF Authors Infinity-Day at...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

PT-2026-107997

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.16.1...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100709 Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...