Shreder

Shreder Shreder est un outil de force brute de mots de passe pour le protocole SSH, multi-thread et puissant. Fonctionnalités Déviation très rapide de mots de passe, un seul mot de passe en 0.1 seconde. Optimisé pour les grandes listes de mots de passe, Shreder essaie 1000 mots de passe en 1 minu...

PassGAN

PassGAN Ce dépôt contient le code de l'article PassGAN: A Deep Learning Approach for Password Guessing. Le modèle de PassGAN est tiré de Improved Training of Wasserstein GANs et il est supposé que les auteurs de PassGAN ont utilisé l'implémentation TensorFlow improvedwgantraining dans leurs...

brutto

brutto Casse de force brute facile pour tout ce que vous voulez, sa magie réside dans l'augmentation des valeurs et le direct. Implémentation Clonez git clone https://github.com/jofpin/brutto.git Téléchargez la dernière version Installez avec Python : python setup.py install So you import the...

win-brute-logon

Notice 1: Nous sommes ravis d'annoncer que notre outil actuel a été porté vers une version PowerShell. Cela signifie que les utilisateurs peuvent désormais accéder et utiliser l'outil directement depuis la ligne de commande PowerShell, ce qui le rend encore plus pratique et efficace à utiliser...

Go365

Go365 v2.0 Correction des problèmes de passerelle AWS merci h0useh3ad ! Ne plante plus lorsque les connexions au serveur proxy échouent Ajout du point de terminaison graph Veuillez lire l'intégralité de ce README avant d'utiliser Go365 ! Go365 est un outil conçu pour effectuer des attaques...

Talon

CE DÉPÔT A ÉTÉ ARCHIVÉ Pour consulter la dernière version de Talon ou soumettre un problème, référez-vous à https://github.com/Tylous/Talon. Talon Talon est un outil conçu pour effectuer des attaques automatisées de devinettes de mots de passe tout en restant indétecté. Talon peut énumérer une...

CVE-2026-44596

CVE-2026-44596 — YAMCS : Absence de limitation de débit sur le point d'authentification Résumé Le point d'authentification POST /auth/token dans yamcs-core ne dispose d'aucune forme de limitation de débit, de verrouillage de compte ou de limitation des tentatives échouées. Un attaquant distant no...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: Отсутствие ограничения скорости на /login позволяет неограниченный перебор паролей Продукт: dgtlmoon/changedetection.io — v0.55.7 Файл: changedetectionio/flaskapp.py CWE: CWE-307 — Ненадлежащее ограничение чрезмерных попыток аутентификации CVSS 3.1:...

CVE-2026-56682

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682

9Router versions prior to 0.5.6 are vulnerable to a login brute-force lockout bypass. The application's rate-limiting mechanism, specifically in src/lib/auth/loginLimiter.js, uses the client-supplied X-9r-Real-Ip header as the bucket key for tracking failed login attempts. When deployed without t...

CVE-2026-56682: Improper Restriction of Excessive Authentication Attempts

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

PT-2026-96821

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description In deployments where requests reach Next.js without the sanitizing custom-server.js wrapper, the application uses the client-supplied X-9r-Real-Ip header as the bucket key for rate limiting. This...

EUVD-2026-72007

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-86186: Improper Restriction of Excessive Authentication Attempts

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

EUVD-2026-68229

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...