CVE-2025-29927_Next.js_Auth_Bypass

CVE-2025-29927 - Next.js Auth Bypass PoC 这是一个用于检测严重影响 Next.js 开发应用的漏洞 CVE-2025-29927 的 Proof of Concept PoC Python 脚本，尤其是在使用中间件进行授权时。 📌 该漏洞可完全绕过认证，在中间件实现不当的情况下访问受保护的路由。 🧠 描述 CVE-2025-29927 允许攻击者在特定路由或配置被攻破时，绕过 Next.js 的认证中间件。这是由于 Edge 运行时与受中间件保护的路由结合时出现意外行为所致。 该 PoC 基于返回的 HTTP 标头，验证服务器是否使用带有中间件的...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST 認証バイパス RCE。 root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host...

CVE-2021-3560

Polkit D-Bus 認証バイパスエクスプロイト polkitシステムサービスには、ローカルの非特権攻撃者が特権操作を実行できる脆弱性が存在します。この脆弱性を悪用するために、攻撃者はD-Bus経由でメソッドを呼び出し、クライアントプロセスを強制終了します。これにより、必要な認証のすべてを受けることなく操作が完了することがあります。エクスプロイトモジュールはこれを利用して、sudoアクセスと既知のパスワードを持つ新しいユーザーを追加します。その後、新しいアカウントを使用して、root権限でペイロードを実行します。...

Custom-Metasploit-Modules

自定义 Metasploit 模块 本仓库包含为教育和娱乐目的而创建的自定义 Metasploit 模块。 目录 模块 在 Metasploit 中加载模块 使用方法 贡献 免责声明 模块 以下是此仓库中可用的自定义 Metasploit 模块列表： 模块 1 zabbixauthbypass 模块 2 ciscobackdoor 模块 3 hikvisiondetect 模块 4 hikvisionauthbypass 模块 5 directorytraversal 模块 6 explodingcan 在 Metasploit 中加载模块 要在 Metasploit 中加载这些模块： ...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

FreeScout < 1.8.224 - Invite Hash Authorization Bypass

FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invitehash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. id: CVE-2026-53595 info:...

Audiobookshelf - Authentication Bypass

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences. id: CVE-2026-71209 info: name:...

MStore API <= 3.9.2 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers ...

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

Service Finder Bookings - Authentication Bypass

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. id: CVE-2025-5947 info: name: Service Finder Bookings -...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

Cyber Cafe Management System 1.0 - SQL Injection

Cyber Cafe Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of th...

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/doctor.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

Sourcecodester Simple Client Management System 1.0 - SQL Injection

Sourcecodester Simple Client Management System 1.0 contains a SQL injection vulnerability via the username field in login.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id:...

Mura CMS <10.0.580 - Authentication Bypass

Mura CMS before 10.0.580 is susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected...

Login as User or Customer < 3.3 - Privilege Escalation

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. id: CVE-2022-4305 info: name: Login as User or Customer 3.3 - Privilege Escalation author: r3Y3r53 severity: critical...

Popup-Maker < 1.8.12 - Broken Authentication

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt aka the...