CVE-2022-3552

CVE-2022-3552 In order to exploit the vulnerability in BoxBlilling, the version will have to be: "BoxBilling=4.22.1.5" and you will have to have valid admin credentials. If you have the situation above, here are the steps you have to take in order to get the juicy RCE: Create a python virtual...

CVE-2023-23752

CVE-2023-23752 About This exploit is Authentication Bypass leaking username password administrator and also leaking mysql config username , password , host and database Vulnerable Version only 4.00 = 4.28 Usage usage: exploit.sh -h -u URL -t TARGETS CVE-2023-23752 - Authentication Bypass...

CVE-2026-108862 APIPark through 1.9.7-beta IDOR via application authorization endpoints

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

EUVD-2026-97013

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

CVE-2026-108862 APIPark through 1.9.7-beta IDOR via application authorization endpoints

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

CVE-2026-108753

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and...

CVE-2026-108584

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the...

Belsen_Group-et-exploitation-de-la-CVE-2022-40684

BelsenGroup and exploitation of CVE-2022-40684 Context On January 29, 2025, a user of the cybercriminal forum BelsenGroup published a message claiming to hold 15,000 compromised Fortinet devices, with configuration files and VPN passwords. He now offers 1,000 exclusive targets for sale on the dar...

CVE-2026-108584 FunnyWolf Viper config hard-coded credentials

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the...

EUVD-2026-96928

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the...

CVE-2026-108584

A security flaw in FunnyWolf Viper (up to version 3.1.11 ) allows for the disclosure of hard-coded credentials . The vulnerability stems from an unknown function within the file /root/viper/.git/config, where specific manipulation can trigger the leak. Remote exploitation is possible, and an expl...

CVE-2026-108753

Versions of Agnaistic agnai through 1.0.555 are affected by a hard-coded credentials vulnerability located in the self-host.docker-compose.yml file. The flaw involves a fixed admin password and a public JWT secret. Unauthenticated attackers can leverage these credentials to log in as an administr...

CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and...

EUVD-2026-96918

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and...

CVE-2026-108742 CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

EUVD-2026-96903

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Una vulnerabilidad de extracción de datos no autenticada en impresoras Kyocera, que permite recuperar la libreta de direcciones en texto claro y las contraseñas de dominio. Resumen de la vulnerabilidad A finales de 2021, durante una prueba de penetración, estaba experimentan...

FortiOS-Credentials-Disclosure

FortiOS-Credentials-Disclosure CVE-2018-13379 Exploit Usage : python CVE-2018-13379.py list.txt...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...