Typecho-Multiple-Vulnerabilities

Typecho Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2024-35538: In Typecho v1.3.0 there is a Client IP Spoofing vulnerability, which allows malicious actors to falsify their IP addresses by specifying an arbitrary IP as value of...

ivantiunlocker

ivantiunlocker Prevent CVE-2025-22457 and other security problems with Juniper/Ivanti Secure Connect SSL VPN Many security issues around SSL VPN devices recently. You can't feel safe anymore. And then there is CVE-2025-22457 ! Read the story behind it :...

CVE-2024-41276

CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...

requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

CVE-2015-3224

Ruby on Rails Web Console Exploit CVE-2015-3224 This repository contains a Python script to exploit an IP whitelist bypass vulnerability in the developer web console of Ruby on Rails 4.0.x and 4.1.x. The script allows for remote code execution on vulnerable servers. ⚠️ Disclaimer This script is...

CVE-2026-55584

CVE-2026-55584 - Bypass de la lista de permitidos de IP de phpSysInfo CWE-290, CVSS 7.5 Alta, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resuelve la IP del cliente a partir de las cabeceras controladas por el atacante X-Forwarded-For luego Client-IP antes de recurrir a...

fireprox

FireProx Resumen Beneficios Descargos Mantenedor Crédito Uso básico Instalación Capturas de pantalla Contribuir Resumen Poder ocultar o rotar continuamente la dirección IP de origen al realizar llamadas web puede ser difícil o costoso. Durante algún tiempo han existido varias herramientas, pero...

transfer.sh

SECURITY WARNING IP filter and HTTP auth bypass via unauthenticated X-Forwarded-For header spoofing transfer.sh Easy and fast file sharing from the command-line. This code contains the server with everything you need to create your own instance. Transfer.sh currently supports the s3 Amazon S3,...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

CVE-2023-4549

CVE ID : CVE-2023-4549 Vulnerability Type : Cross-Site Scripting Description : The DoLogin Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping...

Silent-Call

Silent;Call Root remoto sin autenticación previa en Cisco Unified Communications Manager 15.x Tres solicitudes HTTP. Cero credenciales. Acceso root. Cada llamada ahora es tuya. Kill Chain Paso| Componente| Descripción ---|---|--- 1| Spoofhack| La suplantación de la cabecera X-Forwarded-For elude ...

CVE-2026-105741

The software Langflow (versions 1.5.0 through 1.10.3) is vulnerable to an IP spoofing issue within the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install). An authenticated remote attacker can bypass "local-only" access restrictions by ...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentication Bypass 🔎 Overview CVE-2025-2825 is a critical authentication bypass vulnerability affecting CrushFTP , a widely used secure file transfer server. The flaw allows remote attackers to bypass login authentication and gain administrative access by spoofing...

CVE-2020-35590

Información del exploit Título del exploit: Plugin de WordPress Limit Login Attempts Reloaded 2.13.0 - Bypass del límite de inicio de sesión CVE: CVE-2020-35590 Fecha: 2020-06-09 Autor del exploit: N4nj0 Enlace del software: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Versión:...

CVE-2025-29927

CVE-2025-29927 - Omisión de autenticación en middleware de Next.js Omisión avanzada 🔥 Resumen Un PoC avanzado para CVE-2025-29927 , que permite la omisión de autenticación en Next.js Middleware mediante la manipulación de cabeceras específicas. Esta plantilla mejora las técnicas de evasión de WAF...

CVE-2024-35584

CVE-2024-35584 Inyección SQL autenticada en OpenSIS Descripción Existe una vulnerabilidad de inyección SQL en Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. Esta falla afecta a OpenSis Community Edition 9.1 a 8.0 y posiblemente a versiones anteriores. Prueba de...

CVE-2025-22457

CVE-2025-22457 CVE-2025-22457: Escáner POC de Explotación en Python para Detectar RCE en Ivanti Connect Secure Este script ayuda a identificar gateways de Ivanti Connect Secure, Policy Secure o ZTA que pueden ser vulnerables a CVE-2025-22457 , un desbordamiento de búfer basado en pila, crítico y ...

CVE-2022-46169

Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...