CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...

CVE-2026-21629

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...

CVE-2020-37135

AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can log in with the default admin username and password '1234' to gain unauthorized administrative access to the system...

CVE-2025-66050

Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to the CNA. Possibly all firmware versions...

EUVD-2007-3480

Malware in sbrugna...

EUVD-2006-1288

Malware in sbrugna...

EUVD-2003-0396

Malware in sbrugna...

EUVD-2006-3200

Malware in sbrugna...

EUVD-2024-28997

Malicious code in bioql PyPI...

CVE-2004-1791

The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default login text for the management interface, which allows remote attackers to gain access...

Exploit for Use of Hard-coded Credentials in Tp-Link Tl-Wr845N_Firmware

Poc-CVE-2024-57040 CVE-2024-57040 is a security vulnerability...

The vulnerability of Zyxel CPE series network device microprogramming software lies in the use of rigidly encrypted login credentials, which allows attackers to execute arbitrary codes.

The vulnerability of Zyxel network device software of the CPE series is related to the use of rigidly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using the default login credentials...

CVE-2025-0890

UNSUPPORTED WHEN ASSIGNED Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00AAFR.4C020170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but...

Chef Web UI Brute Force Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/chefwebui' require 'metasploit/framework/credentialcollection' class MetasploitModule 'Chef Web UI Brute Force Utility',...

CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

CVE-2024-31086

Cross-Site Request Forgery CSRF vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting XSS.This issue affects Change default login logo,url and title: from n/a through 2.0...

CVE-2024-31086

CVE-2024-31086 is a CSRF-to-XSS vulnerability in the WordPress plugin “Change default login logo-url-and-title” affecting versions up to 2.0. The issue arises from a CSRF flaw that can lead to XSS on login page customization. No vendor-specific remediation or patch details are provided in the con...

The vulnerability of the microprogrammed software of the hybrid digital video recorder Hitron Systems DVR LGUVR-4H, related to the use of default login credentials, allows a violator to trigger a service failure.

The vulnerability of the microprogramming software of the hybrid digital video recorder Hitron Systems DVR LGUVR-4H is related to the use of default login credentials. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by using the default network identifier...

WordPress Change default login logo,url and title Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Change default login logo,url and title Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31086 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 9e9f68e4407b Credits...

CVE-2024-21833

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi...