WPForce

WPForce - Wordpress 공격 스위트 소개: WPForce는 Wordpress 공격 도구 모음입니다. 현재 이 모음에는 2개의 스크립트가 포함되어 있습니다 - API를 통해 로그인을 무차별 대입 공격하는 WPForce와, 관리자 자격 증명이 발견되면 셸을 업로드하는 Yertle입니다. Yertle에는 또한 다수의 사후 침투post exploitation 모듈이 포함되어 있습니다. 자세한 내용은 블로그 게시물을 참조하세요:...

CVE-2023-27742

CVE-2023-27742 IDURAR ERP/CRM v1 には、コンポーネント /api/login を介した SQL インジェクションの脆弱性が存在することが発見されました。 Description IDURAR ERP/CRM v1 には、コンポーネント /api/login を介した SQL インジェクションの脆弱性が存在することが発見されました。 Vulnerability Type SQL インジェクション Vendor of Product IDURAR ERP/CRM v1 Affected Product Code Base...

CVE-2025-55462

CVE-2025-55462 脆弱性の概要 Eramba Community Edition および Enterprise Edition v3.26.0 において、クロスオリジンリソース共有（CORS）の設定ミスが確認されました。このアプリケーションは /system-api/login エンドポイントにおいて、攻撃者が制御する Origin ヘッダーを Access-Control-Allow-Origin レスポンスヘッダーに反映するとともに、Access-Control-Allow-Credentials: true を設定します。...

CVE-2025-65427

CVE-2025-65427: Dbit N300 T1 Pro における認証レート制限の問題 CVE ID: CVE-2025-65427 日付: 2025-12-16 発見者: Kirubel 製品: Dbit N300 T1 Pro Easy Setup ワイヤレスWi-Fiルーター ファームウェアバージョン: V1.0.0 説明 Dbit N300 T1 Pro Easy Setup ワイヤレスWi-Fiルーター ファームウェアバージョン V1.0.0 で問題が発見されました。このデバイスは /api/login エンドポイントにレート制限を実装していません CWE-307。...

CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391: Missing Critical Step in Authentication

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

VulnCheck KEV: CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

PT-2026-84529

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...

CVE-2026-18721

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

EUVD-2026-52570

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

CVE-2026-18721: URL Redirection to Untrusted Site

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

PT-2026-67636

A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...

MAL-2026-11005 Malicious code in n8n-nodes-quick-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive she...

CVE-2026-32825

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

PT-2026-61631

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-55207: Weak Password Recovery Mechanism for Forgotten Password

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...