CVE-2025-24071

Security Vulnerability Report: CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Overview NSFOCUS CERT has detected that Microsoft recently released a security update to address a critical spoofing vulnerability in Windows File Explorer, identified as CVE-2025-24071. This vulnerabilit...

CVE-2025-24071-POC-NTLMHashDisclosure-

CVE-2025-24071-POC-NTLMHashDisclosure Triggers automatic SMB authentication to an attacker-controlled share. No interaction required — Windows Explorer initiates this NTLM authentication automatically. Results in NTLMv2 hash leakage information disclosure. Affects Windows 10/11 all versions,...

CVE-2025-50154

CVE-2025-50154, CVE-2025-59214 Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure By Ruben Enkaoua and Cymulate First Blog: Zero Click, One NTLM: Microsoft Security Patch Bypass CVE-2025-50154 Second Blog: Patched Twice, Still Bypassed: New NTLM Leak CVE-2025-50154 Patch Bypass Descripti...

CosmicRakp

CosmicRakp Table of Contents Introduction CVE-2013-4786 Installation Usage Credits License Introduction CosmicRakp is a powerful tool written in Go that allows red teamers and penetration testers to dump IPMI hashes. This project aims to be efficient, fast, and easy to use. CVE-2013-4786 This too...

Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...

CVE-2026-27553

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2025-24071

CVE-2025-24071 — Windows File Explorer Spoofing / NTLM Hash Disclosure via .library-ms ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal...

cve-2025-24054-lab

CVE-2025-24054 — Detection & Mitigation Lab Project log for a defensive security lab on CVE-2025-24054 , the Windows New Technology LAN Manager NTLM Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term. Blue-team educational project...

CVE-2025-52488

DNN Unicode Path Normalization NTLM Hash Disclosure Exploit CVE-2025-52488 Overview This exploit targets a vulnerability in DNN formerly DotNetNuke versions 6.0.0 to before 10.0.1 that allows attackers to disclose NTLM hashes through Unicode path normalization attacks. Vulnerability Details CVE I...

CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

CVE-2026-55072

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Unauthenticated SQL Injection Description The PoC SQL injection will dump WordPress users and hashes. Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable f...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor Script A comprehensive Cobalt Strike Aggressor script that weaponizes and executes malicious LNK files and Library-MS files for SMB NTLMv2-SSP hash disclosure. Includes CVE-2025-24054 bypass techniques. ⚠️ DISCLAIMER This tool is for educational and researc...

cve-2024-43451-ntlm_hash_disclosure_reproduction

CVE-2024-43451 — Windows NTLM Hash Disclosure Spoofing Vulnerability Overview CVE-2024-43451 is an NTLMv2 hash disclosure spoofing vulnerability in Windows. It allows an unauthenticated remote attacker to leak a victim's NTLM hash by convincing them to interact with a malicious .url shortcut file...

cve-2025-24071

CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. ⚠️ This is for educational and research purposes only. Do not use this on production...

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Securi...

CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

BIT-GHOST-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...