CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentication Bypass 🔎 Overview CVE-2025-2825 is a critical authentication bypass vulnerability affecting CrushFTP , a widely used secure file transfer server. The flaw allows remote attackers to bypass login authentication and gain administrative access by spoofing...

N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 id: CVE-2026-86206 info: name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing author:...

unKover

unKover Uncover what's forbidden. 403 bypass tester by Brute Logic. Part of the King of Noobs suite — offensive recon tools built on KISS and the Pareto principle. Simple, fast, and effective. What It Does unKover tests a URL returning 403 Forbidden or 401 Unauthorized against a set of proven...

0xMiddleware

CVE-2025-29927: Next.js Middleware Exploit This tool demonstrates and automates the exploitation of CVE-2025-29927 , a vulnerability in Next.js that allows an attacker to bypass middleware checks like authentication by abusing the internal header x-middleware-subrequest. 🔧 How the Exploit Works...

CVE-2026-124719

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0...

CVE-2026-35616

CVE-2026-35616 Author: wa6n3r | GitHub | Web Description Exploitation of the certificate chain verification bypass vulnerability in the Fortinet API. The script automatically discovers valid Common Names CN from various sources, generates a fake client certificate, and performs requests to...

EUVD-2026-125079

FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $SERVER...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Bypass ⚠️ Critical Authentication Bypass in NextJS Middleware 🛠️ PoC implementation by @zs1n 💡 Overview NextJS is a popular React-based web framework, has an authentication vulnerability that affects versions prior to 12.3.5, 13.5.9,...

CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What is Gitea? Gitea is a lightweight, open-source Git hosting platform that allows organizations and developers to manage source code repositories, track issues, review changes, and collaborate on software projects. It provides functionalit...

CVE-2025-29927

CVE-2025-29927 — Next.js middleware authorization bypass Summary: vulnerability in Next.js middleware allowing authorization bypass by spoofing the x-middleware-subrequest header. Table of Contents CVE-2025-29927 — Next.js middleware authorization bypass Table of Contents Gathering vulnerable hos...

CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

CVE-2022-31813

Launch the Range docker compose up --build Normal Access GET / HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/145.0.0.0 Safari/537.36 Accept:...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

CVE-2022-46169

CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions before 1.2.3 Here remoteclientauthorized checks the clients hostname in poller table for entry function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname = gethostbyaddr$clientaddr; // ... $pollers =...

Exploit for Authentication Bypass by Spoofing in Litellm

CVE-2026-49468 — LiteLLM — некорректный парсинг Host Лаборато...

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Summary The Echo proxy middleware middleware/proxy.go preserves an incoming X-Real-IP header verbatim and forwards it to the upstream service when EchoIPExtractor is not configured — which is the default. Because any HTTP client can supply an arbitrary X-Real-IP value, an attacker can cause Echo ...

CVE-2026-114640 Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client- headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticate...

CVE-2026-108905

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...