CVE-2026-41940

CVE-2026-41940: Bypass de Autenticación de cPanel/WHM Objetivo Único y Múltiple Aviso legal: Este documento y el script asociado exploit.py se proporcionan estrictamente con fines educativos, investigación de seguridad y pruebas de penetración autorizadas. No utilice este software contra sistemas...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

Azure-APIM-Cross-Tenant-Signup-Bypass

Bypass de registro entre inquilinos de Azure APIM Estado 01.12.2025: Esta vulnerabilidad sigue activa y explotable. Microsoft no ha corregido este problema y lo considera «por diseño». Aviso de seguridad GHSA-vcwf-73jp-r7mv CVE-2025-66390 Resumen Una vulnerabilidad de seguridad en el portal para...

CVE-2026-41940

CVE-2026-41940: Bypass de autenticación en cPanel/WHM objetivo único y múltiple Aviso legal: Este documento y el script asociado exploit.py se proporcionan estrictamente con fines educativos, investigación de seguridad y pruebas de penetración autorizadas. No utilice este software contra sistemas...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

phishery

phishery Phishery es un servidor HTTP simple con SSL habilitado cuyo propósito principal es obtener credenciales mediante Autenticación Básica. Phishery también proporciona la capacidad de inyectar fácilmente la URL en un documento Word .docx. El poder de phishery se demuestra mejor configurando ...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

CVE-2026-8181

CVE-2026-8181 Prueba de Concepto Investigación • Validación • Pruebas de Seguridad "las rosas son rojas, las violetas son azules, creo que me acabo de cagar en los pantalones pensando en ti. rizz" Resumen de CVE Campo| Valor ---|--- CVE ID| CVE-2026-8181 Tipo| Omisión de autenticación Impacto|...

CVE-2026-90461

A flaw was found in OpenStack Ironic. When the Image Service is configured for HTTPS Basic Authentication, Ironic may inadvertently transmit a username and password to an unintended remote host. This could lead to the disclosure of sensitive authentication credentials to an attacker who controls...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-41940

CVE-2026-41940 - Bypass de autenticación de cPanel/WHM Este repositorio contiene un informe expurgado en inglés y una herramienta de verificación basada en Go para CVE-2026-41940, una omisión de autenticación de cPanel/WHM causada por inyección CRLF en el manejo de la autenticación básica. Todas...

PT-2026-90517

CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication. https://t.co/ar9eeuKgWS...

Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials

Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...

CVE-2026-8181

CVE-2026-8181 Esta vulnerabilidad permite a atacantes no autenticados que conozcan un nombre de usuario de administrador válido hacerse pasar por ese administrador durante las solicitudes a la API REST mediante el uso de cualquier contraseña incorrecta en una cabecera de autenticación básica. Los...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...