CVE-2016-6210-Exploit

This is the first version of the "weaponized" exploit for CVE-2016-6210 Background: Posted by Eddie Harari on Full Disclosure http://seclists.org/fulldisclosure/2016/Jul/51 The brief: By sending large passwords, a remote user can enumerate users on system that runs SSHD. This problem exists in mo...

rscrypto

rscrypto rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FF...

libsodium

Sodium is an easy-to-use software library that provides a wide range of cryptographic operations including encryption, decryption, digital signatures, and secure password hashing. It is a portable, cross-compilable, installable, and packageable fork of NaCl. While maintaining API compatibility,...

openssh_dos

Since OpenSSH servers don't restrict the login password length, you can cause these servers to crash by sending very long passwords which use massive amounts of a the server's CPU to hash. This vulnerability is known as CVE-2016-6515. My POC can be downloaded here you will need to unzip Usage:...

hmac-bcrypt

hmac-bcrypt このリポジトリには、hmac-bcrypt パスワードハッシュ関数のリファレンス実装が複数の言語で含まれています。各リファレンス実装は、可能な限り @epixoip によって作成されたオリジナルのCおよびPerl実装の1:1ポートとなることを試みており、相互に完全に互換性があります（つまり、同じハッシュ値を生成・検証します）。 インターフェース 各リファレンス実装は、以下の擬似プロトタイプを持つ2つの手続き型関数を定義しています。 string hmacbcrypthashpassword, settings?, pepper? boolean...

cve-2022-22976-bcrypt-skips-salt

BCrypt ハッシュチェック CVE-2022-xxxx の緩和対策のために、このツールを使用してデータベース内の更新が必要なハッシュを確認できます。 アプリケーションを データベースと統合 した後、ツールは2つのステップで動作します。 これを実証するために、インメモリのサンプルアプリケーションが使用されます。 そのサンプルアプリケーションで、次のように check ステップを実行できます： ./mvnw spring-boot:run@check これにより、サンプルデータベース内の更新が必要なBCryptハッシュがチェックされます。 次に、次のように update...

wargame-turkey_in_2

wargame 1. フラグファイルの分割 2. ブルートフォース防止 - delay 50005s 3. ロギング 4. パスワードハッシュ化 -wargame-turkeyin2...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

EUVD-2026-82992

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) uses MD5-based password hashing in firmware versions prior to 1.2412b260707 (V1) and 2.2412b260519 (V2). Because MD5 is a cryptographically weak algorithm, an attacker who obtains the device configuration file can recover the privil...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

EUVD-2026-81576

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-92921

admin3 (versions through 3.0.0 ) stores account passwords using single-round MD5 with only the username as salt and no key derivation function, as seen in its SecurityUtil.java and UserCredential.java source files. Because MD5 is computationally inexpensive, an attacker with database access can r...

EUVD-2026-73927

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...