secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Assurance Drift Working reproduction for a proposed security challenge inspired by CVE-2026-88861 , published 10 September 2026. Security concept The application correctly verifies a signed session and correctly checks the admin role, but it collapses two...

TREVORspray

TREVORspray 2.0 TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more! By @thetechr0mancer Installation: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray See the...

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2023-23192

CVE-2023-23192 CVE-2023-23192- Userlock - Multi-Factor Authentication MFA Bypass Exploit Title: Userlock - Multi-Factor Authentication MFA Bypass Date: 01/11/2023 Exploit Author: Pinar Sadioglu Vendor Homepage: https://www.isdecisions.com/products/userlock/help/ Version: = 11.0.1.40 Tested on:...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 We access the wordpress website where we will see that it has MFA activated through the vulnerable plugin: We must execute the PoC and provide the access credentials: Automatically, the browser will open using ...

joomla-bruteforce

joomla-bruteforce Joomla login bruteforce Tested on Joomla! 3.8.8 Usage: python3 joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin chmod +x joomla-brute.py ./joomla-brute.py -u http://10.10.10.150 -w /usr/share/wordlist/rockyou.txt -usr admin Optional parameters...

CVE-2026-57490

Prior to version 3.16.0 , the self-hosted file manager FileRise is vulnerable to an authentication bypass when WebDAV is enabled. The root cause lies in the public/webdav.php authentication callback, which validates only the username and password via AuthModel::authenticate() while failing to enf...

CVE-2026-57490 FileRise: WebDAV authentication bypasses TOTP/MFA entirely

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-89074

Progress MOVEit Transfer is vulnerable to a security issue caused by improper handling of unicode encoding . This vulnerability affects versions prior to 2025.1.6 and versions from 2026.0.0 up to (but before) 2026.0.4 . The impact includes potential bypass of email MFA. No specific exploit detail...

CVE-2026-89074 MOVEit Transfer Email MFA Bypass

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-48558

CVE-2026-48558: SimpleHelp OIDC Authentication Bypass !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. This exploit demonstrates a critical remote code execution RCE...

CVE-2025-3639

CVE-2025-3639 PoC - Liferay Portal/DXP Login Bypass This repository contains a Proof of Concept PoC for CVE-2025-3639 , a login bypass vulnerability in Liferay Portal versions 7.3.0–7.4.3.132 and Liferay DXP various versions from 2024.Q1 to 2025.Q1.6. The PoC demonstrates how an unauthenticated...

cuddlephish

CuddlePhish Browser-in-the-middle BitM multi-usuario armado para probadores de penetración. Este ataque puede usarse para eludir la autenticación multifactor en muchas aplicaciones web de alto valor. Incluso funciona para aplicaciones que no usan tokens de sesión y, por lo tanto, no serían...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

CVE-2025-67070-Intelbras-CFTV-MFA-Bypass

Intelbras NVD 9032 R Ftd – Vulnerabilidad crítica de restablecimiento de contraseña Descubierto por: Theo Cia CVE: CVE-2025-67070 Estado: Reportado al proveedor Fecha de descubrimiento: Noviembre 2025 Impacto: Acceso administrativo completo mediante bypás de MFA Firmware: V2.800.00IB00C.0.T Build...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Bypass MFA WordPress - Exploit Lab This repository provides a lab for exploiting the CVE-2024-10924 vulnerability in WordPress, specifically to bypass two-factor authentication MFA and gain access to the WordPress administration panel. Prerequisites To deploy this lab in your...

CVE-2024-8122

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

EUVD-2024-55782

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

CVE-2024-8122

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). Because unused OTPs remain valid indefinitely, malicious actors can conduct brute force attacks by repeatedly guessing the code over an unlimited timeframe....

PT-2026-107723

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...