📄 OpenAM Authentication Bypass

OpenAM versions prior to 14.6.6 proof of concept exploit. / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ || || / // || / / / Name: watchtowr-vs-openamauth-impersonation2022-06-16.py Author: Aliz Hammond import json import re import textwrap import...

CVE-2022-25454

Tenda AC6 v15.03.05.09multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function...

CVE-2020-15024

An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation...

CVE-2020-28096

FOSCAM FHD X1 1.14.2.4 devices allow attackers with physical UART access to login via the ipc.fos password...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

Triple-Identity Authentication: the Future of Secure Access

In a typical authentication process, the local system verifies the user's identity using a stored hash value generated by a cross-system hash algorithm. This article shifts the research focus from traditional password encryption to the establishment of gatekeeping mechanisms for effective...

Centron 19.04 - Remote Code Execution (RCE)

Exploit Title : Centron 19.04 - Remote Code Execution RCE Tested on Centreon API 19.04.0 Centreon 19.04 - Login Password Bruteforcer Written on 6 Nov 2019 Referencing API Authentication of the Centreon API document Author: st4rry centbruteon.py Centreon Download Link:...

Consumer Comanda Mobile 安全漏洞

Consumer Comanda Mobile is a mobile ordering system from Consumer. A security vulnerability exists in Consumer Comanda Mobile versions 14.9.3.2 and earlier and 15.0.0.8 and earlier, which stems from mishandling of the parameter Login/Password in the restaurant order processing component, which...

PT-2025-15129 · Unknown · Consumer Comanda Mobile

Name of the Vulnerable Software and Affected Versions: Consumer Comanda Mobile versions 14.9.3.2 through 15.0.0.8 Description: A problematic issue has been found in Consumer Comanda Mobile, affecting an unknown part of the Restaurant Order Handler component. The manipulation of the Login/Password...

CVE-2025-24517

Use of client-side authentication issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication...

CVE-2025-24517

Use of client-side authentication issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication...

Inaba Denki Sangyo CHOCO TEI WATCHER mini 安全漏洞

Inaba Denki Sangyo CHOCO TEI WATCHER mini is a series of surveillance cameras from Inaba Denki Sangyo. A security vulnerability exists in Inaba Denki Sangyo CHOCO TEI WATCHER mini, which stems from client-only authentication, and could lead to an attacker obtaining the product's login password...

PT-2025-4539 · Unknown · Ldap Login Password/Role Manager

Name of the Vulnerable Software and Affected Versions: ldap login password and role manager versions 1.0.12 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an...

Astra Linux – Vulnerability in freeipa

There is a cross-site request forgery vulnerability in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions on behalf of the user, resulting in a loss of confidentiality and system integrity...

CVE-2024-45372

The CVE-2024-45372 issue affects PLANEX MZK-DP300N firmware versions 1.04 and earlier. It is a cross-site request forgery (CSRF) vulnerability in the web management page that can cause a logged-in user viewing a malicious page to perform unintended operations, such as changing the login password....

PT-2024-31585 · Planex · Planex Mzk-Dp300N

Name of the Vulnerable Software and Affected Versions: PLANEX MZK-DP300N firmware versions 1.04 and earlier Description: The issue is related to a cross-site request forgery vulnerability. Viewing a malicious page while logging in to the web management page of the affected product may lead the us...

PT-2024-30026 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Management System affected versions not specified Description: The issue is related to a SQL injection vulnerability. It occurs via the password parameter at the "login.php" endpoint. There is no information provided about the estimate...

CVE-2024-40883

CVE-2024-40883 is a Cross-site request forgery vulnerability in ELECOM wireless LAN routers. The issue occurs when an administrator views a malicious page while logged into affected devices, which may cause unintended actions such as changing login credentials. Connected documents identify affect...

The vulnerability of the login_password component in the FreeIpa server allows a attacker to perform a CSRF attack.

The vulnerability of the loginpassword component in the FreeIpa server relates to the sending of user requests that can perform actions on behalf of the user. Exploiting this vulnerability could allow a malicious actor to carry out a CSRF attack remotely...

The vulnerability of the run() function in the FreeIPA server’s script allows a perpetrator to gain unauthorized access to protected information or cause service failures.

The vulnerability of the run function in the ipautil.py script of the FreeIPA server is related to insufficient validation of input data during session establishment when processing the user parameter /sip/session/loginpassword. Exploiting this vulnerability can allow a malicious actor to gain...