POC-CVE-2022-30600

Proof of concept for CVE-2022-30600 Overview This repository contains 2 implementations for a proof of concept which exploits CVE-2022-30600. CVE-2022-30600 is a security vulnerability which allows an attacker to bypass the account lockout threshold within the moodle webapp. As outlined by the...

CVE-2022-31007-Python-POC

Python automation of the following write up on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0. Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electron...

iDict

Disclaimer: Do whatever you want with this code as long as you give me credit @Pr0x13 Check and make sure its legal in your country to use this tool before doing so. I'm not responsible for any damage done whatsoever to anyones iCloud account or iDevice. I Didn't exploit any accounts while writin...

BIT-PARSE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when...

CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

Spray365

What is Spray365? Spray365 is a password spraying tool that identifies valid credentials for Microsoft accounts Office 365 / Azure AD. How is Spray365 different from the many other password spraying tools that are already available? Spray365 enables passwords to be sprayed from an "execution plan...

ZITADEL MFA Lockout Bypass

ZITADEL versions before 2.50.0 lack lockout handling for failed TOTP and OTP checks, allowing repeated second-factor authentication attempts. Version 2.50.0 fixes the issue...

CVE-2026-113710

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2026-113710

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

EUVD-2026-104574

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768

Parse Server versions prior to 8.6.99 and 9.0.0 before 9.10.3-alpha.2 are vulnerable to an Information Disclosure vulnerability. The root cause is that the system evaluates checks against a target account during a user update before authorizing the caller, reflecting the outcome in the response. ...

PT-2026-117619

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.99 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description An issue exists where the server evaluates checks against a target account during a user update before authorizing the caller and reflects the...

CVE-2026-112768: Incorrect Authorization

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-63442

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-63442

Prior to version 26.1.11 , OPNsense is vulnerable to a log forgery flaw due to the unauthenticated WebGUI login usernamefld accepting carriage-return and line-feed characters. These characters survive LOG_AUTH processing and are injected into the syslog-ng destination feeding the lockout_handler....

CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...