open-sammy

SAMMY Código Abierto v2 Este repositorio aloja la versión de código abierto de SAMMY, la herramienta OWASP SAMM. https://owasp.org/www-project-open-sammy/ Licencia Este proyecto está licenciado bajo la Licencia Creative Commons Attribution-ShareAlike 4.0 International. Consulta el archivo LICENSE...

unknownpwn.github.io

Tecnovision LED Video Wall Vulnerabilities and Exploits. From SQLi to full root access. Introduction: Tecnovision is a manufacturer of LED Video Walls used in arenas For example, Twickenham Stadium, concert halls, shopping malls, as roadsigns and much much more. DlxSpot Player 4 is the software...

mcafee_atd_CVE-2019-3663

McAfee ATD CVE-2019-3663 McAfee Advanced Threat Defense ATD 4.6.x and earlier - Hardcoded root password Security Bulletin: https://kc.mcafee.com/corporate/index?page=content&id=SB10304 Interesting shadow entries root@kitploit:...

Lockbit-Black-3.0

Lockbit-Black-3.0 Password is: 1234...

Viessmann Vitogate 300 - Hardcoded Password

A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface. id: CVE-2023-5222 info: name: Viessmann Vitogate 300 - Hardcoded Password author: ritikchaddha severity: critical description: | A critica...

CVE-2024-22853

CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750A1FWv101b03 tiene una contraseña hardcodeada para la cuenta de Alphanetworks, lo que permite a atacantes remotos obtener acceso root a través de una sesión telnet. PoC...

datapower-redis-rce-exploit

datapower-redis-rce-exploit CVE-2020-5014 Un POC para el exploit RCE de Redis autenticado de IBM DataPower que abusa de la función "Send a Test Message". Explicación completa y demo en YouTube Publicación de blog en tomcope.com Explicación Usando la función "Send a Test Message" de DataPower...

CVE-2020-25078

CVE-2020-25078 Instrucciones de uso Instrucciones Coloque la URL de ataque en el mismo directorio que ip.txt La IP de ataque se coloca en el mismo directorio que ip.txt Registro de terminal root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt...

Poc-CVE-2024-57040

Poc-CVE-2024-57040 CVE-2024-57040 is a security vulnerability found in certain TP-Link TL-WR845N router models. Specifically, it involves a "hardcoded" password for the router's root account. This means a default, unchanging password is built into the router's software. Affected Devices: The...

CVE-2024-56429

CVE-2024-56429 Access to the local database of the iLabClient Extract database password The iLabClient uses an Apache Derby database to store the locally required data. To ensure the encryption, a bootPassword is used for the creation, which can be extracted from the source code the extracted cod...

CVE-2022-1162

CVE-2022-1162 A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. Exploit: New Gitlab Accounts...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

CVE-2026-90456

CVE-2026-90456 affects a bundled inventory-management component whose example environment-configuration file ships with a fixed, publicly-known administrative password . If a deployment copies this example file into active configuration without running the setup routine that regenerates credentia...

CVE-2022-26138

CVE-2022-26138 1. Introducción POC de contraseña codificada de Confluence 2. Uso root@kitploit: poc -f host.txt // escaneo masivo poc -h 192.168.1.1 // escaneo individual 3. Aviso de descargo de responsabilidad Esta herramienta se utiliza únicamente para el aprendizaje, la investigación y la...

CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

CVE-2026-77012

CVE-2026-77012 affects the 爱采集数据采集和发布插件 (Icollect) WordPress plugin, versions through 1.0.0 . The root cause is a hardcoded default publishing password on an unauthenticated endpoint combined with missing validation of URLs and destination paths. This allows unauthenticated attackers to perform a...

PT-2026-71873

A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level o...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...