Proxmox VE - Default Credentials with TFA Bypass

Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password "root@pam" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement an...

CVE-2025-57428

⚠️ 이 저장소는 CVE-2025-57428에 대한 참고 자료로만 유지됩니다. 다른 권고 및 업데이트는 security-advisories를 참조하십시오. CVE-2025-57428 - 기본적으로 활성화된 Telnet 디버그 인터페이스로 인해 저수준 플래시/레지스터 접근 가능 영향을 받는 제품 공급업체/브랜드: Each Italy 장치: Wireless Mini Router WIRELESS-N 300M 펌웨어: v28K.MiniRouter.20190211 요약 이 장치는 Telnet 디버그 인터페이스를 기본적으로 포트 23에서...

gerapy-cve-2021-43857

Gerapy CVE-2021-43857 인증된 RCE 이 저장소는 CVE-2021-43857 에 대한 개념 증명 익스플로잇을 포함하고 있습니다. 이는 Gerapy -p -L -P 요구 사항 1. Python 3.x 2. requests 및 pyfiglet pip install requests pyfiglet 3. Netcat nc...

CVE-2023-37073

CVE-2023-37073 Telnetのデフォルト認証情報により、情報漏洩やサービス拒否（DoS）攻撃が発生する可能性があります。 再現手順 これはAP AR-5310に影響します。 root@kitploit: Telnet 192.168.1.1 username:user password:user その後、Boom... ログインできました Telnetのデフォルト認証情報による情報漏洩 root@kitploit: Telnetサービスにログインしたら、 コマンド「help」または「?」を入力すると、 利用可能なオプションが表示されます。 reboot, ping,...

EUVD-2026-67295

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

CVE-2026-77977

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

CVE-2026-77977 Ebyte NA111-M Missing Authentication for Critical Function

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

PT-2026-82797

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

EUVD-2026-66426

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5...

CVE-2026-76155

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-76155

Datiphy Data Management Center versions v8.3.0 through v8.5.1 ship with default administrator credentials, enabling unauthenticated remote attackers to gain full administrative access. CVSS 9.3 CRITICAL; no patch or exploitation evidence provided in documents. Upgrade to a patched version or chan...

CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

EUVD-2026-63795

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-76392

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for...

CVE-2026-76392 Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for...

EUVD-2026-60389

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...

CVE-2025-27621

UpTrain ≤0.7.1 ships a static default API key derived from a hardcoded username and an open CORS policy, letting any website send authenticated cross-origin requests via the uptrain-access-token header and perform privileged actions. CVSS 8.7 HIGH. No patch is available; monitor the GitHub adviso...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-74891

The openssl_encrypt npm package (versions before 1.4.0) ships standalone server configuration files containing hardcoded, well-known default PostgreSQL credentials. Network-accessible attackers can connect to exposed PostgreSQL instances and retrieve sensitive data. No exploitation evidence is pr...

PT-2026-76804

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTH ENABLED=true but the undocumented, defaultless INTERNAL SERVICE SECRET environment variable is unset, the is internal request check in src/memos/api/middleware/auth.py fails open:...