CVE-2024-54820

Vulnérabilité : Injection SQL non authentifiée - Extraction de mots de passe en clair Auteur : Javier Carabantes Logiciel concerné : XOne Web Monitor Logiciel : https://xone.es/ Version concernée : 02.10.2024.530 framework 1.0.4.9 Description Une vulnérabilité d'injection SQL non authentifiée a é...

cve-2019-17240

Bludit = 3.9.22 - Contournement de l'atténuation par force brute Ceci est un petit projet où je réécris ce script Python en Golang. Le but de ce projet était d'apprendre Golang et de comprendre le fonctionnement de cette exploitation. Utilisation $ ./brutepass -sdasds flag provided but not define...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 Une vulnérabilité de cross-site scripting XSS réfléchie dans /authenticationendpoint/login.do de WSO2 Api Manager antérieur à la v4.2.0 permet à des attaquants d'exécuter des scripts web ou du HTML arbitraires via une charge utile conçue injectée dans le paramètre...

HTC

Взлом CCTV Учетные данные DVR раскрыты | CVE-2018-9995 | Утечка логинов CCTV для доступа к системе Как использовать? Откройте https://www.zoomeye.org/ Найдите этот ключевой запрос '/login.rsp' Подождите, чтобы получить IP и порт $ python3 thecctv.py Больше информации ОС | Язык | Контакты...

CVE-2025-10294

Exploit: Обход аутентификации через пустой ownidsharedsecret Подделка JWT 1 Создание действительного JWT с помощью пустого ключа HMAC SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

CVE-2024-57610

Sylius v2.0.2의 속도 제한 부재 Vendor Homepage: https://sylius.com/ 재현 단계 1. https://store.sylius.com/login 으로 이동합니다. 2. 자동화 도구나 스크립트예: Burp Suite, cURL를 사용하여 여러 번의 로그인 요청을 시도합니다. 3. 속도 제한이 적용되지 않고 요청이 제한 없이 처리되는 것을 확인합니다. Poc video https://drive.google.com/file/d/1o5nd8eStt0tgBpKJHUay02NHVAUntPM/view...

CVE-2026-36959

CVE-2026-36959: Отсутствие ограничения скорости на конечной точке входа CVE ID: CVE-2026-36959 Дата: 2026-04-29 Исследователь: Kirubel Solomne Производитель: U-SPEED Продукт: Маршрутизатор U-SPEED Версия прошивки: V1.0.0 CWE: CWE-307 — Некорректное ограничение чрезмерных попыток аутентификации...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit Le plugin WP Directory Kit pour WordPress est vulnérable à un contournement d'authentification dans toutes les versions jusqu'à la 1.4.4 incluse, en raison d'une implémentation incorrecte de l'algorithme d'authentification dans la fonctionwdkgenerateautologinlink...

CVE-2025-60375

CVE-2025-60375 — Обход аутентификации в PerfexCRM Идентификатор рекомендации: perfexcrm-auth-bypass-2025 CVE: CVE-2025-60375 Продукт: PerfexCRM Затронутые версии: версии до 3.3.1 3.3.1 Сообщили: Ajansha Shankar, Ahamed Yaseen Ссылки: Памятка OWASP по аутентификации —...

CVE-2024-7591-PoC

CVE-2024-7591-PoC Ces scripts Python PoC testent le LoadMaster de Kemp pour une exécution de code à distance. CET OUTIL EST DESTINÉ UNIQUEMENT À DES FINS DE TEST Ces scripts ont été basés sur l'article de Marius Walter concernant les spécificités de cette exploitation. Vous pouvez lire son post à...

CVE-2026-9082

CVE-2026-9082 Injection SQL non authentifiée dans Drupal Core sur PostgreSQL via POST /user/login, escaladée en exécution de code à distance via sessionpreloadlibraries de PostgreSQL. Contrairement aux exploits publics existants qui ciblent JSON:API, celui-ci utilise le point de terminaison de...

CVE-2026-102248

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

EUVD-2026-88625

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-102248 Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-102248

A vulnerability exists in the Login Endpoint component of Rebuild up to versions 4.4.7/4.5.0-beta5 . The flaw is located within an unspecified part of the /user/login file and results in improper authentication . Attackers can initiate this attack remotely . While the exploit is publicly availabl...

CVE-2026-102248 Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

UBUNTU-CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...