CVE-2025-3639

CVE-2025-3639 PoC - Bypass di Login Liferay Portal/DXP Questo repository contiene un Proof of Concept PoC per CVE-2025-3639 , una vulnerabilità di bypass del login in Liferay Portal versioni 7.3.0–7.4.3.132 e Liferay DXP varie versioni da 2024.Q1 a 2025.Q1.6. Il PoC dimostra come un utente non...

CVE-2017-7921-EXPLOIT

CVE-2017-7921 - Vulnerabilità di autenticazione impropria nelle serie di telecamere Hikvision Una falla di sicurezza identificata come CVE-2017-7921, che colpisce vari modelli di telecamere Hikvision. La vulnerabilità è stata scoperta nei dispositivi delle serie DS-2CD2xx2F-I V5.2.0 build 140721...

CVE-2026-78246

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

EUVD-2026-64828

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246 itsourcecode Online Clinic Management System Admin Login login.php sql injection

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246

A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 , specifically in the Admin Login component (file success/login.php). The root cause is the unsanitized handling of the Username argument, allowing an unauthenticated remote attacker to inject arbitrary SQL. ...

Astra Linux – Vulnerability in pam-pkcs11

PAM-PKCS11 is a Linux-PAM login module that enables user login using X.509 certificates. Prior to version 0.6.13, if certpolicy was set to none the default value, then pampkcs11 would only check whether the user was capable of logging into the token. An attacker could create a new token using the...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

CVE-2026-78201

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file adminclass.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the publ...

EUVD-2026-64740

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file adminclass.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the publ...

sshprank

Description A fast SSH mass-scanner, login cracker, banner grabber and password auth checker tool using the python-masscan and shodan module. Usage root@kitploit: hacker@blackarch $ sshprank -H / / / / / / / / / / / / /// | / / / // / / / // / / / / , opts | mode options -h - single host, cidr,...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Advisory di sicurezza: Cross-Site Scripting persistente non autenticato che porta al takeover dell'account amministratore openclaw-dashboard Titolo: OpenClaw Dashboard v3.0.0 Stored XSS tramite il campo Username del login fallito ID CVE assegnato: CVE-2026-66418 Repository target:...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS RCE non autenticata tramite bypass del login automatico 📋 Panoramica CVE-2026-9198 è una vulnerabilità critica di Remote Code Execution RCE non autenticata in IBM Langflow OSS. Questo exploit combina due vulnerabilità: CVE-2026-9103 : Bypass del login automatico c...

CVE-2025-6563

Sicherheitshinweis zu Reflected XSS in der MikroTik-Hotspot-Anmeldeseite Übersicht In der Hotspot-Anmeldeseite von MikroTik RouterOS wurde eine Schwachstelle für Reflected Cross-Site Scripting XSS entdeckt. Die Schwachstelle wird über den URL-Parameter dst ausgelöst, dessen Eingabe nicht...

PT-2026-80808

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0 Description An issue in the Admin Login component allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. T...

CVE-2025-3605

🚀 Guia de Exploração do CVE-2025-3605 🛡️ Resumo da Vulnerabilidade O plugin Frontend Login and Registration Blocks para WordPress versões = 1.0.7 é vulnerável a escalada de privilégios via tomada de conta. O problema ocorre porque o plugin não valida a identidade do usuário ao atualizar detalhes...

CVE-2025-49029

🚨 Plugin WordPress Custom Login And Signup Widget 🔥 Punteggio Base: 9.1 CRITICO ID CWE: CWE-94 – Controllo improprio della generazione di codice 'Code Injection' 🧠 Descrizione Il plugin consente agli amministratori di modificare il contenuto di sn.php tramite il campo Nome del mittente nella pagi...

zyxel-social-login-bypass-cve-2026-8508

CVE-2026-8508: Bypass do Portal Cativo da Zyxel via Identidade do Facebook Submetida por Navegador Confiável Este repositório reúne o relatório público, o script de verificação rápida e artefatos de suporte selecionados para CVE-2026-8508. O que é isso CVE-2026-8508 é uma falha de fronteira de...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - bypass bruteforce - CVE-2019-17240 Script molto semplice basato su CVE-2019-17240. POC originale e spiegazione: https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...