bmc_bladelogic

BMC Bladelogic RSCD remote exploits for Linux and Windows Change passwords, List users and Remote code execution Exploiting vulnerabilities in BMC BladeLogic RSCD agent CVE-2016-1542 BMC-2015-0010 CVE-2016-1543 BMC-2015-0011 CVE-2016-5063 Published on exploit-db BMCrexec.py...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM Auth Bypass + Root Password Changer This script exploits an authentication bypass vulnerability in cPanel/WHM CVE-2026-41940 using a CRLF injection technique to forge an administrator session. Once successful, the script can change the root user's password in WHM and...

CVE-2024-42849

CVE-2024-42849 An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. Writeup If the password change request is intercepted and a sufficiently long1MB string is supplied as the password to use, system resources will be...

CVE-2025-28355

CVE-2025-28355 It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks, one of the many action an attacker can perform is trick a legitimate user to run a cross site request that will alter his/her password, allowing the attacker...

CVE-2023-42820

CVE-2023-42820 CVE-2023-42820 Vulnerability Description JumpServer Password Reset Vulnerability USAGE V2 Update 1. Complete refactoring 2. Added default account and email when no account or email is received 3. Improved recognition and calculation of CAPTCHA 4. Automatically modify password 5...

CVE-2026-73292

CVE-2026-73292 – CSRF Password Change in Semaphore UI For educational and responsible disclosure purposes only. This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21. Vulnerability The password change endpoint of Semaphore UI does not implement...

CVE-2023-4696

CVE-2023-4696 Account Takeover Due to Improper Handling of JWT Tokens in memos v0.13.2 Description I want to shed light on a significant security vulnerability I recently discovered within the usememos/memos system. This vulnerability has the potential to allow any user to modify another user’s...

DLLPasswordFilterImplant

DLLPasswordFilterImplant DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in th...

CVE-2024-57429

CVE-2024-57429 A cross-site request forgery CSRF vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Impact: Exploitation of this CSRF...

CVE-2022-37932

HP Switch Firmware Authentication Bypass Vulnerability CVE-2022-37932 Firmware Version: PD.02.21 Affected Devices: HP 1920 Series Smart Managed Switches Overview This repository documents a critical authentication bypass vulnerability in HP 1920 Series Smart Managed Switches running firmware...

CSRF-breach

Security breach project - Cross Site Request Forgery Dolibarr 7.0.0 is affected by: Cross Site Request Forgery CSRF. The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Remote Code Execution : CVE-2020-35846 Description Cockpit CMS has some NoSQL Vulnerabilities which can be used to dump users' information, This information disclosures can be chained together to change users' passwords and which leads to Remote Code Execution on th...

CVE-2024-42850

CVE-2024-42850 An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. Writeup When changing your password, upon submission of the new password, the password is first sent in a POST request to an endpoint which checks t...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Li...

Jrohy-trojan-unauth-poc

Jrohy/trojan Unauthorized modification of administrator password 中文版本Chinese version Jrohy/trojan is an open source project based on Go to automatically deploy trojan services. Its web-side initialization interface /auth/register failed to close properly after user configuration, allowing...

CVE-2024-48887-FortiSwitch-Exploit

CVE-2024-48887-FortiSwitch-Exploit 🚨 FortiSwitch CVE-2024-48887 PoC JavaScript 🚨 🔥 Just dropped a lightweight JavaScript snippet showcasing how unauthorized password changes can be triggered on vulnerable Fortinet FortiSwitch GUI endpoints. 🛠️ About the Vulnerability: An attacker can craft a simpl...

CVE-2023-46449

CVE-2023-46449 Incorrect Access Control VIDEO POC LINK https://www.youtube.com/watch?v=H5QnsOKjs3s Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via...

Azure-AD-Password-Checker

Azure AD Password Checker In an Azure AD environment, it's possible to determine whether a user has Multi-Factor Authentication MFA disabled without requiring any special privileges. This can be accomplished by analyzing the account's creation date and last password change date. If an account's...

CVE-2022-27434

CVE-2022-27434 UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page. The vulnerability exist in the error page generated by the application in this case: while changing password. Adding quotation mark to...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...