Pyrit

Please Read Pyrit is old, is outdated and it's still Python2 I am currently attempting to rewrite it from scratch, so thanks for all the stars but remember to keep an eye for Python3 version. Pyrit Pyrit allows you to create massive databases of pre-computed WPA/WPA2-PSK authentication phase in a...

CVE-2021-29156

CVE-2021-29156 Доказательство концепции c 2021 GuidePoint Security Charlton Trezevant [email protected] Предыстория Сегодня GuidePoint рада выпустить функциональный инструмент для демонстрации уязвимости CVE-2021-29156 — LDAP-инъекции в ForgeRock OpenAM v13.0.0. Эта уязвимость позволяет...

grafana-bruteforce

grafana-bruteforce 사용자 이름과 비밀번호 조합 목록을 받아 grafana 로그인 페이지를 무작위 대입bruteforce 시도하는 도구입니다. Grafana는 5회 시도 후 잠기므로 프록시에 여러 외부 IP가 있는지 확인해야 합니다. 실행 방법 제공된 조합 목록 사용 root@kitploit: python3 grafana-brute.py -u http://localhost:3000 자신만의 조합 목록 사용. root@kitploit: python3 grafana-brute.py -u...

CVE-2026-36959

CVE-2026-36959: 로그인 엔드포인트의 속도 제한 누락 CVE ID: CVE-2026-36959 날짜: 2026-04-29 발견자: Kirubel Solomne 공급업체: U-SPEED 제품: U-SPEED 라우터 펌웨어 버전: V1.0.0 CWE: CWE-307 - 과도한 인증 시도에 대한 부적절한 제한 설명 U-SPEED 라우터 펌웨어 V1.0.0은 /api/login 엔드포인트에 속도 제한 또는 계정 잠금 보호 기능을 구현하지 않습니다. 이로 인해 로컬 네트워크의 공격자가 무제한으로 인증 시도를 수행할 수 있으며...

CVE-2024-11318

CVE-2024-11318 IDOR - AbsysNet 2.3.1 ユーザーハイジャッキング 免責事項 このツールは、アプリケーションがこの特定の CVE-2024-11318 に対して脆弱であるかどうかを特定し、悪用するための支援を目的として設計されています。これは、サイバーセキュリティの専門家、研究者、ペネトレーションテスターが、明示的な許可を得た環境でセキュリティを評価するために使用することを意図しています。 脆弱性が確認された場合でも、悪用はアプリケーションまたはシステムの所有者から適切な許可を得た場合にのみ実行してください。...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as an undocumented login path. Unlike get_api_signIn , which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), this endpoint performs the same credential c...

EUVD-2026-72008

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187

WWBN AVideo is vulnerable to password recovery via weak PRNG in its external-login account creation process. Passwords are generated using rand() rather than a cryptographically secure generator, yielding only 31-bit integers that are further weakened by unsalted MD5 hashing. An attacker with acc...

CVE-2026-82644

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-81697

The openssl-encrypt PyPI package (versions ≤ 1.4.8) contains a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE—originally set to the absolute per-user path ~/.crypt_settings.json—is reassigned at line 84 to the bare relative name crypt_settings.json. The le...

EUVD-2026-67053

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

Astra Linux – Vulnerability in Chromium

A cryptographic flaw in PDFium in Google Chrome prior to version 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs through a brute-force attack. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-1199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

CVE-2024-6832 describes an account locking failure in multiple WSO2 products where the lockout is not triggered if secondary user stores are inaccessible. The root cause is that the system does not maintain a consistent lockout state across all configured stores, enabling an attacker to perform r...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

PT-2026-66447

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-65894 Improper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an...