CVE-2020-26061

CVE-2020-26061 ClickStudios Passwordstate Password Reset Portal Authentication Bypass Information Vendor: ClickStudios Product: Passwordstate Versions Affected: Before 8.5 build 8501 Researcher: Jason Juntunen aka @missing0x00 https://github.com/missing0x00 Description ClickStudios Passwordstate...

ActiveMQ_CVE-2023-46604

ActiveMQCVE-2023-46604 Python implementation for rapidly constructing concurrent data traffic packets; both gadget classes are implemented, org.springframework.context.support.FileSystemXmlApplicationContext and org.springframework.context.support.ClassPathXmlApplicationContext, FileSystemXml can...

CVE-2026-89022

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at...

CVE-2026-54503

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, includi...

CVE-2026-54547

meta-ads-mcp is a Model Context Protocol server for Meta Ads by Pipeboard. Prior to version 1.0.115, an authentication bypass in AuthInjectionMiddleware (http_auth_integration.py:259) lets an unauthenticated network caller send any X-Pipeboard-Token header value to pass the request guard. Because...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2018-0296

CVE-2018-0296 测试CVE-2018-0296并从Cisco ASA中提取用户名。 更多技术细节请参考 https://sekurak.pl/opis-bledu-cve-2018-0296-ominiecie-uwierzytelnienia-w-webinterfejsie-cisco-asa/。 帮助菜单 root@kitploit: $ ./CVE-2018-0296 -h 选项: -h, --help 显示帮助信息 -u, --url 目标设备的URL -i Socks代理的IP -p Socks代理的端口 -t, --time 循环之间休眠的秒数 --loop...

CVE-2013-6117

CVE-2013-6117 root@kitploit: $ ./CVE-2013-6117 -h Options: -h, --help display help information -f, --filename File containing list of IP addresses -t, --target Target IP -n, --threads No of concurrent threads default: 100 root@kitploit: $ ./CVE-2013-6117 -f hostfile.txt...

CVE-2026-55701

A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...

CVE-2025-29927

CVE-2025-29927 - Next.js 中间件授权绕过 PoC 这是一个基于 夺旗（CTF） 风格的漏洞概念验证，适用于 Next.js 中间件授权绕过 漏洞（CVE-2025-29927 ）。目标是通过绕过认证中间件，从 /protected 路由获取旗标。 漏洞概要 CVE : CVE-2025-29927 类型 : 授权绕过 组件 : Next.js 中间件 影响 : 未授权访问受保护的路由 PoC 目标路由 : /protected 预期行为 : 未授权用户被重定向到 / 漏洞行为 : 使用精心构造的请求可以绕过重定向，直接访问受保护内容 PoC 环境搭建 1. 克隆仓...

CVE-2026-12742

IBM Business Automation Workflow (both containers and traditional deployments) is affected by a missing authorization control that allows an authenticated attacker to trigger restricted import actions. The root cause is insufficient authorization checks on import-related functions. Per CVSS 3.1, ...

loxs-optimized

loxs-optimized Project from https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Note: It mainly bypasses the CSP payload 2024-11-06 Add CSP-Bypass-xss.txt to xss.txt 2024-11-07 Removing interfering information Only the vulnerable information is displayed 2024-11-11 Solves the problem that the...

CVE-2025-20029

CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and...

CVE-2026-53710 MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the pythonsandboxserver in mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py exposes raw getattr through safebuiltins, omits a required getattr guard, and relie...

CVE-2026-46488

motionEye (mEye) , the web interface for the motion video surveillance system, is vulnerable to authentication bypass prior to version 0.44.0 . The server accepts the client-controlled meye_username and meye_password_hash cookies as sufficient authentication material without server-side session v...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-54503

plone.app.textfield (used by Plone CMS) has a stored XSS in RichTextValue.output: when the stored mimeType equals the outputMimeType, the safe_html transform is bypassed entirely and the raw value is emitted via tal:content="structure" without escaping. An attacker with write access to a RichText...

EUVD-2026-78836

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, includi...

CVE-2026-54503 plone.app.textfield: Stored XSS by spoofing mime type

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, includi...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...