Lucene search
+L

283 matches found

Kitploit
Kitploit
•added 2026/09/26 6:17 a.m.•18 views

TREVORspray

TREVORspray 2.0 TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more! By @thetechr0mancer Installation: root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray...

6.3AI score
SaveExploits0References8
Kitploit
Kitploit
•added 2026/09/25 7:35 p.m.•15 views

cuddlephish

CuddlePhish 为渗透测试人员打造的武器化多用户浏览器中间人(BitM)攻击工具。该攻击可用于绕过许多高价值 Web 应用的多因素认证。即使在不使用会话令牌的应用中也能生效,因此传统的令牌窃取攻击无法利用这些应用。这是一款社会工程学工具,不会利用目标服务的任何技术缺陷。 快速开始 该工具是一个专门的 Web 服务器,设计运行在 Debian 11 Bullseye Linux 服务器上,并依赖公网 IP 信息来保护管理功能。如果不费一番周折,别指望能在本地测试。 警告:Chromium 不支持 ARM。虽然技术上可以强制使用 ARM 版 Chromium 二进制文件,但会失去...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
•added 2026/09/25 3:18 p.m.•6 views

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Deriva de garantía Reproducción funcional para un desafío de seguridad propuesto inspirado en CVE-2026-88861 , publicado el 10 de septiembre de 2026. Concepto de seguridad La aplicación verifica correctamente una sesión firmada y comprueba correctamente el rol...

8.7CVSS6AI score0.00523EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/25 10:18 a.m.•12 views

CVE-2023-23192

CVE-2023-23192 CVE-2023-23192- Userlock - Multi-Factor Authentication MFA Bypass Exploit Title: Userlock - Multi-Factor Authentication MFA Bypass Date: 01/11/2023 Exploit Author: Pinar Sadioglu Vendor Homepage: https://www.isdecisions.com/products/userlock/help/ Version: = 11.0.1.40 Tested on:...

7.2CVSS7.5AI score0.01476EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/24 7:10 p.m.•7 views

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

8.1CVSS6.1AI score0.00579EPSS
SaveExploits2
CVE
CVE
•added 2026/09/24 5:34 p.m.•10 views

CVE-2026-85056

The identity management platform ZITADEL is vulnerable to an MFA bypass in Login V2 (versions 4.0.0 through 4.16.1). The root cause is that the system creates a browser session after password verification and allows it to be reused for subsequent requests without verifying enrolled TOTP, OTP, or ...

8.2CVSS5.8AI score0.00285EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/24 5:34 p.m.•6 views

EUVD-2026-86324

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

8.2CVSS5.8AI score0.00285EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/24 5:34 p.m.•5 views

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

8.2CVSS5.8AI score
SaveExploits0References6
OSV
OSV
•added 2026/09/24 4:23 p.m.•4 views

CVE-2026-94606 authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

8.9CVSS5.8AI score
SaveExploits0References17
CVE
CVE
•added 2026/09/24 4:23 p.m.•13 views

CVE-2026-94606

The open-source identity provider authentik is vulnerable to an MFA Bypass via state confusion and parameter injection in the AuthenticatorEmailStage . Prior to versions 2026.2.7, 2026.5.7, and 2026.8.2 , the system accepts an email address supplied in the setup request rather than the one establ...

8.9CVSS5.8AI score0.00489EPSS
SaveExploits0References15
CVE
CVE
•added 2026/09/24 4:06 p.m.•9 views

CVE-2026-79763

The web-based server management platform Termix (versions 2.4.0 through 2.5.1) is vulnerable to a regression that allows MFA-critical operations to be performed using only an account password. Specifically, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints in src/backend/da...

5.3CVSS5.8AI score0.00315EPSS
SaveExploits0References5
Kitploit
Kitploit
•added 2026/09/24 2:54 p.m.•11 views

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 Accedemos a la página web de wordpress donde veremos que tiene MFA activado a través del plugin vulnerable: Debemos ejecutar la PoC y proporcionar los datos de acceso: De forma automática, se abrirá el navegado...

9.8CVSS7.5AI score0.82025EPSS
SaveExploits21References1
NVD
NVD
•added 2026/09/21 8:17 p.m.•9 views

CVE-2026-58271

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

6.8CVSS0.00219EPSS
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/21 4:41 p.m.•8 views

CVE-2026-48558

CVE-2026-48558: Omisión de Autenticación OIDC en SimpleHelp !WARNING Este código se proporciona TAL CUAL únicamente con fines educativos y de investigación. No utilice este PoC en sistemas de producción, entornos compartidos ni en objetivos no autorizados. Este exploit demuestra una vulnerabilida...

10CVSS6.2AI score0.05719EPSS
SaveExploits3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/21 12:00 a.m.•2 views

CVE-2026-94379: Improper Input Validation

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

6.9CVSS5.8AI score0.00578EPSS
SaveExploits0References3
Kitploit
Kitploit
•added 2026/09/20 11:55 p.m.•15 views

joombrute

JoomBrute Kit moderno de ataques de autenticación para Joomla J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227 Descripción Kit de ataques de credenciales para Joomla que cubre las versiones 3, 4 y 5 del CMS. Seis subcomandos manejan la cadena de ataque completa de principio a fin:...

7.5CVSS7.1AI score0.99827EPSS
SaveExploits43References2
Kitploit
Kitploit
•added 2026/09/20 7:16 p.m.•13 views

CVE-2025-3639

CVE-2025-3639 PoC - Liferay Portal/DXP Login Bypass This repository contains a Proof of Concept PoC for CVE-2025-3639 , a login bypass vulnerability in Liferay Portal versions 7.3.0–7.4.3.132 and Liferay DXP various versions from 2024.Q1 to 2025.Q1.6. The PoC demonstrates how an unauthenticated...

2CVSS6.1AI score0.00503EPSS
SaveExploits1References1
Kitploit
Kitploit
•added 2026/09/20 2:20 a.m.•10 views

CitrixBleedCVE-2026-8452-2025-5777

Herramienta de Explotación CitrixBleed - CVE-2025-5777 y CVE-2026-8452. Lectura remota de memoria no autenticada desde Citrix NetScaler ADC y Gateway. Roba tokens de sesión de administrador, extrae hashes de nsroot, extrae secretos y evita MFA. Exploit en Python 3 con análisis completo de memoria...

9.8CVSS8.4AI score0.99972EPSS
SaveExploits21
Kitploit
Kitploit
•added 2026/09/19 6:40 p.m.•10 views

CVE-2025-67070-Intelbras-CFTV-MFA-Bypass

Intelbras NVD 9032 R Ftd – Vulnerabilidad crítica de restablecimiento de contraseña Descubierto por: Theo Cia CVE: CVE-2025-67070 Estado: Reportado al proveedor Fecha de descubrimiento: Noviembre 2025 Impacto: Acceso administrativo completo mediante bypás de MFA Firmware: V2.800.00IB00C.0.T Build...

5.7AI score0.00372EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/19 1:36 a.m.•12 views

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Bypass MFA WordPress - Laboratorio de Exploit Este repositorio proporciona un laboratorio para explotar la vulnerabilidad CVE-2024-10924 en WordPress, específicamente para omitir la autenticación de dos factores MFA y obtener acceso al panel de administración de WordPress. Requisit...

9.8CVSS7.5AI score0.82025EPSS
SaveExploits21
Rows per page
Query Builder