cpanel-cve-2026-41940-ioc

CVE-2026-41940 IOC Scanner Detection script for the cPanel/WHM authentication bypass CVE-2026-41940 affecting all cPanel versions after 11.40. This is a rewrite of the upstream cPanel detection script with fixes for false positives and added log correlation. What it does Scans...

CVE-2025-3102

CVE-2025-3102 The SureTriggers WordPress plugin contains a critical authentication bypass vulnerability CVE-2025-3102 that affects all versions up to and including 1.0.78...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt JwtAuthenticator authentication bypass Full buildout: writeup, Java in-process PoC, Python token-forge CLI and library, tests. Summary CVE: CVE-2026-29000 CVSS 10, CWE-347 Affected: pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 when using JWE + signature config Issue: JWE-wrapped...

cve-2026-33032-scanner

CVE-2026-33032 Scanner Non-destructive vulnerability scanner for Nginx-UI MCP Endpoint Authentication Bypass Vulnerability Overview CVE-2026-33032 is an authentication bypass vulnerability in nginx-ui's Model Context Protocol MCP integration. The /mcpmessage endpoint lacks authentication middlewa...

CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - Functional PoC MongoDB Memory Leak Exploitation - Simulated R6 Attack Complete Proof of Concept for CVE-2025-14847 MongoBleed Tested: ✅ MongoDB 7.0.5 | 14,300+ Successful Exploits | 4 Leaked UUIDs 🎯 About the Project This repository contains a fully functional Proof of...

smb-usermap

Samba "username map script" Command Execution This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

cve-2026-29145

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2026-02-26 Affected Vendor: Apache Affected Product: Tomcat Severity: 9.1 CRITICAL CWE: CWE-287 Improper Authentication Status: Under Review /...

CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2023-52268 Overview This exploit targets a vulnerability in the FreeScout End-User Portal Module versions below 1.0.65 that allows an attacker to bypass authentication through improper session token management. By generating and testing...

GNU-Inetutils-telnet-CVE-2026-24061-

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass Vulnerability Detection Tool 📋 Project Overview This is an advanced detection tool for the GNU Inetutils Telnetd authentication bypass vulnerability CVE-2026-24061. This vulnerability has a CVSS score of 9.8, allowing attackers to obtain...

CVE-2022-46169

CVE-2022-46169 - Unauthenticated Remote Code Execution in Cacti What is Cacti and its vulnerability? Cacti is an open-source operational monitoring tool written in PHP, MySQL/MariaDB, which provides a friendly interface. The vulnerability was found in 2022 which affected all versions before 1.2.2...

CVE-2026-24061

CVE-2026-24061 Reproduction Steps Build the image docker build -t telnetd-bypass . Start the container docker run -it --rm \ --name telnetd-vuln \ --privileged \ -p 23:23 \ telnetd-bypass Send the payload USER='-f root' telnet -a 127.0.0.1 23 Output Trying 127.0.0.1... Connected to localhost...

CVE-2024-54916

CVE-2024-54916: Authentication Bypass on Telegram apk An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by manipulating the return value of the checkPasscode method. Vulnerability Type...

CVE-2026-39987-lab-or-marimo-cve-lab

CVE-2026-39987 Lab Guide Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass An educational Docker lab for understanding, reproducing, and patching this critical vulnerability in marimo. Table of Contents Overview Architecture Quick Start Step-by-Step Walkthrough Step 1:...

CVE-2026-9830

-orange?style=for-the-badge CVE-2026-9830 — BookingPress Pro Authentication Bypass Comprehensive Cybersecurity Threat Intelligence Investigation Overview • Reports • Key Findings • Technical Details • Risk Assessment • Mitigation • References 📋 Overview CVE-2026-9830 is a critical authentication...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...

CVE-2026-28372-telnetd-Privilege-Escalation

CVE-2026-28372: GNU inetutils telnetd Privilege Escalation Professional Proof-of-Concept PoC for CVE-2026-28372, a Local Privilege Escalation LPE vulnerability found in GNU inetutils telnetd versions ≤ 2.7. Technical Summary The vulnerability occurs because telnetd improperly passes...

CVE-2026-29000-pac4j-jwt-auth-bypass

HTB Principal — CVE-2026-29000 Writeup Disclaimer: This exploit was developed solely for the retired HackTheBox machine "Principal". For educational purposes only. Do not use against systems you do not own or have explicit permission to test. Machine Info Field| Details ---|--- Name| Principal...

CVE-2026-24061-Scanner

CVE-2026-24061 Scanner: GNU Inetutils Telnet Exploit Checker CVE-2026-24061 Scanner is a Bash Script-based tool for performing detection reconnaissance and active verification active exploitation check of the Authentication Bypass vulnerability in the telnetd service of the GNU Inetutils package...

CVE-2026-64638-POC

CVE-2026-64638 — XSS2Shell Pre-Authentication Reflected XSS → Remote Code Execution in WordPress Core ⚠️ DISCLAIMER: This repository is for authorized security research and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Unauthorize...