weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

CVE-2025-4094-POC

WordPress Plugin Digits Bypass de OTP CVE-2025-4094 Resumen Este script es un exploit para el plugin Digits de WordPress versiones -p -i OPCIONES Argumentos -u, --url: Requerido URL objetivo p.ej., https://example.com/wp-admin/admin-ajax.php -p, --phone: Requerido Número de teléfono objetivo solo...

CVE-2025-4094

CVE-2025-4094 – Complemento Digits de WordPress 8.4.6.1 - Omisión de Autenticación OTP Autor: Saleh Tarawneh ID CVE: CVE-2025-4094 Gravedad: Crítica CVSS 9.8 Estado: Corregido en la versión 8.4.6.1 Descripción de la Vulnerabilidad El complemento Digits de WordPress anterior a la versión 8.4.6.1 e...

MGASA-2026-0361 Updated perl-Date-Manip packages fix security vulnerabilities

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...

Updated perl-Date-Manip packages fix security vulnerabilities

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...

OESA-2026-3539 perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian...

TencentOS Server 4: perl-Date-Manip (TSSA-2026:0864)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0864 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-28165

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

CVE-2026-28165

Unauthenticated Privilege Escalation in the WordPress Digits plugin (versions <= 9.2), discovered by VanTastic via Patchstack. The flaw requires no authentication or user interaction, is network-exploitable with low complexity, and carries a CVSS 9.8 (CRITICAL) score with high impact on confid...

CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

CVE-2026-28165 WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

EUVD-2026-64794

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

PT-2026-80827

Name of the Vulnerable Software and Affected Versions Digits versions prior to 9.3 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update to a version newer than 9.2...

CVE-2026-28165: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

JLSEC-2026-1348 Wasmtime doesn't fully sandbox all the Windows device filenames

Impact Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so...

WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by VanTastic in WordPress Plugin Digits versions = 9.2...

SUSE-SU-2026:23218-1 Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. - CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution ...

SUSE-SU-2026:23229-1 Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. - CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution ...

CVE-2026-60074

A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...

CVE-2026-68494

This CVE notes an incomplete fix for CVE-2026-18401 in jackson-core’s non-blocking parser, leaving a remaining bypass for number-length constraints when data is streamed in many small chunks. The issue arises in the async parser path (MINOR_NUMBER_INTEGER_DIGITS) where validateIntegerLength() is ...