CVE-2022-31007-Python-POC

Python による自動化スクリプトです。対象は、こちらの記事で説明されている elabFTW のアカウントロックアウト回避およびログインブルートフォースです。この脆弱性はバージョン 4.1.0 より前の elabFTW に影響します。 両スクリプトは、脆弱なバージョンの elabFTW（フリーかつオープンソースの電子実験ノート）を実行している Proving Grounds Practice のラボ「Source」に対して使用できます。 アカウントログインにはメールアドレスが必要なため、ブルートフォースでユーザー名を試す前に、潜在的なユーザーの有効なドメインを把握しておく必要があります...

Spray365

Spray365란 무엇인가? Spray365는 Microsoft 계정Office 365 / Azure AD에 대한 유효한 자격 증명을 식별하는 비밀번호 스프레이 도구입니다. Spray365가 이미 존재하는 다른 많은 비밀번호 스프레이 도구들과 어떻게 다른가요? Spray365는 "실행 계획"에서 비밀번호를 스프레이할 수 있게 해줍니다. 스프레이 작업을 훨씬 전에 미리 생성된 실행 계획을 가지고 있으면 Spray365가 활용하는 많은 다른 이점이 있지만, 이는 또한 네트워크 오류나 기타 중단 후에 비밀번호 스프레이를 재개-R 옵...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

EUVD-2026-84542

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

EUVD-2026-84112

@sync-in/server vulnerable to TOTP Brute-Force via POST /api/app/sync/register...

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...

iDict

免責事項: このコードは、私（@Pr0x13）にクレジットを与える限り、好きに使って構いません。 使用する前に、あなたの国でこのツールの使用が合法であることを確認してください。 私は、誰かのiCloudアカウントやiDeviceに生じたいかなる損害についても責任を負いません。 これを書いている間にアカウントを悪用したことはありませんし、テストすらしていません（動くといいですね）。 私はただ観察して報告しただけです。 インストール: Xamppインストール内のHtDocsフォルダに配置してください。 お使いのOS用のcUrlをインストールしてください...

POC-CVE-2022-30600

CVE-2022-30600 の概念実証 概要 このリポジトリには、CVE-2022-30600 を悪用する概念実証のための 2 つの実装が含まれています。 CVE-2022-30600 は、攻撃者が moodle Web アプリケーション内のアカウントロックアウトしきい値をバイパスできるようにするセキュリティ脆弱性です。 NVD データベース（https://nvd.nist.gov/vuln/detail/CVE-2022-30600）の以下のエントリで概説されているように、以下のバージョンがこのエクスプロイトに対して脆弱であることが知られています。 3.9 - 3.9.13 3.1...

Astra Linux – Vulnerability in Tomcat9

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protections provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

PT-2026-89299

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

PT-2026-83292

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269: Authentication Bypass Using an Alternate Path or Channel

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

PT-2026-81990

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-1199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2026-8793 PaperCut NG/MF: Insufficient brute-force protection

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...