CVE-2022-39841

CVE-2022-39841 Medusa's leaky WebSocket For more information please read the blog post Summary A critical vulnerability in Medusa allows for information leakage, including plaintext credentials, by attaching to an unauthenticated WebSocket and waiting for a user to make a configuration change...

CVE-2021-22911-rust

CVE-2021-22911 A rust proof of concept for this CVE. Used as part of https://tryhackme.com/room/rocket, a CTF boot to root on the TryHackMe learning platform. To use, update the constants in main.rs and run, and it should work straight off. Requires that you have the admin email address and...

CVE-2020-25078

CVE-2020-25078 Instructions instructions Place the attack URLs in the same directory as ip.txt The attack IP is placed in the same directory as ip.txt Terminal log root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt https://xxx.xxx.xxx.xxx:3128...

gha-lab-8aba6b05dc

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of CloudPirates-io/helm-charts at commit...

CVE-2026-36436-Public-Reference-Pack

CVE-2026-36436-Public-Reference-Pack Summary A vulnerability in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code using standard browser developer tools to...

CVE-2021-27187

CVE-2021-27187 Suggested description The FX Aggregator terminal client by "Sovremennye Delovye Tekhnologii" stores authentication credentials in cleartext in login.sav when the Save Password box is checked. VulnerabilityType Other CWE-522 Insufficiently Protected Credentials Vendor of Product OOO...

gha-lab-456dd8a245

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of skim-rs/skim at commit...

CVE-2026-108783

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-108783 PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

EUVD-2026-97137

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-108783

A security vulnerability exists in PRVTPRO Amnezia-Web-Panel versions up to 1.6.2/1.7.2 . The flaw is located within the Backup Download component, specifically affecting an unspecified part of the app.py file. This issue allows for the use of default credentials , which can be exploited via a re...

PT-2026-110710

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.0 through 0.11.3 Description Authenticated non-admin users with tool export permission can obtain the full Python source code of tools shared with them in read-only mode. This occurs when requesting the 'GET...

CVE-2026-102539: Cleartext Storage of Sensitive Information

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

PT-2026-110563

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109321: Use of Weak Credentials

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

CVE-2026-109293: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

CVE-2026-109566: Use of Hard-coded Credentials

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

PT-2026-110410

Name of the Vulnerable Software and Affected Versions PRVTPRO Amnezia-Web-Panel versions prior to 1.6.3 PRVTPRO Amnezia-Web-Panel versions prior to 1.7.3 Description A remote attack is possible in the Backup Download component within the app.py file. This issue allows the use of default credentia...

CVE-2026-85951: Server-Side Request Forgery (SSRF)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or...

CVE-2026-85952: Server-Side Request Forgery (SSRF)

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud...