CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - i-doit Pro 25 及以下版本中的硬编码管理员凭据 i-doit Pro 25 及以下版本存在硬编码管理员凭据漏洞。该漏洞使任何人都可以使用用户名“admin”和密码“admin”登录为管理员。 产品描述：i-doit 是一款基于 Web 的开源 IT 文档和 CMDB（配置管理数据库）软件，由 synetics GmbH 开发。i-doit Pro 是该软件的商业版本，需要付费许可。它附带了额外功能、专业支持以及定期更新和增强功能。用户需要购买许可证才能使用 i-doit Pro，其费用根据用户数量和所需功能而有所不同。 漏洞描述：我们发现该...

recon-skills

🛡️ Recon & Pentest Skill Pack 169 habilidades ofensivas de seguridad para reconocimiento y pentest. Técnicas validadas en campo a partir de más de 600 objetivos corporativos en más de 45 sectores. Actualizado con evasión de huellas de navegador, bypass anti-bot, búsqueda de credenciales...

CVE-2024-28987-POC

描述： SolarWinds Web Help Desk WHD 软件存在硬编码凭据漏洞，允许远程未认证用户访问内部功能并修改数据。 潜在影响： 利用 CVE-2024-28987 可能允许攻击者绕过 SolarWinds Web Help Desk 实施的安全策略，从而导致未经授权访问敏感数据、修改配置或其他恶意操作，进而危及系统完整性。鉴于 Web Help Desk 在企业及政府等关键环境中的广泛使用，该漏洞存在重大风险。 修复： 该公司已在 Web Help Desk 12.8.3 HF2 版本中发布补丁以修复此漏洞。强烈建议用户将软件更新至此版本或更高版本以防范此漏洞。 变通方...

CVE-2024-28987

CVE-2024-28987 CVE-2024-28987 概念验证利用：SolarWinds Web Help Desk 硬编码凭据漏洞 概述 提取最多25张最新票据（API限制） 获取每张票据的完整详情 分析票据ID以估算系统中的总票据数 以结构化目录格式组织输出 设计思路 本工具基于该漏洞的其他利用方法开发。其他利用程序（如MSFconsole）会截断输出，而我希望能查看所有票据的完整内容。 使用方法 root@kitploit: python3 solarexploit.py -u https://target.com -o outputdirectory -d...

CVE-2024-28987

CVE-2024-28987: Vulnerabilidad de credenciales codificadas en SolarWinds Web Help Desk Prueba de concepto para explotar CVE-2024-28987 en servidores vulnerables. Publicación del blog Causa raíz e indicadores de compromiso aquí:...

CVE-2026-73519-WolfStack-PoC

CVE-2026-73519 — Secreto de clúster codificado en WolfStack → RCE no autenticado PoC de un secreto de autenticación predeterminado codificado en WolfStack que permite a un atacante remoto no autenticado ejecutar comandos arbitrarios como root dentro de cualquier contenedor Docker/LXC administrado...

POC-CVE-2022-26671

如果你来到这里，你明白为什么需要创建这个仓库。 CVE-2022-26671 GET /AT/ATDefault.aspx 第430行包含明文凭据。 secom | supervisor 关于负责任的披露，当它是登录页面时，不披露硬编码的明文HTTP响应体是愚蠢的。 https://nvd.nist.gov/vuln/detail/CVE-2022-26671...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

PT-2026-71705

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0 Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token JWT secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the...

CVE-2026-58245

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...

EUVD-2026-55875

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...

CVE-2025-13293

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through...

CVE-2025-59180

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

CVE-2025-59180

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

EUVD-2025-210515

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

CVE-2026-12628

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager FCM authentication mechanism. The application contains a...

CVE-2026-12628

CVE-2026-12628 affects IBM Storage Protect Client (8.1.0.0–8.2.1.0) and IBM Storage Protect Snapshot for Windows (8.1.0.0–8.2.1.0). The IBM security bulletin confirms a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism and multiple authentication code paths, enabling re...