self-service-password

LDAP Tool Box Self Service Password Presentation Self Service Password is a PHP application that allows users to change their password in an LDAP directory. The application can be used on standard LDAPv3 directories OpenLDAP, OpenDS, ApacheDS, Sun Oracle DSEE, Novell, etc. and also on Active...

CVE-2019-15107

CVE-2019-15107 Webmin RCE Error - Perl execution Failed Your password has expired, and a new one must be chosen.uid=0root gid=0root groups=0root Failed to change password : The current...

CVE-2022-1597

CVE-2022-1597 El plugin, utilizado como complemento para los temas Discy y Himer, no sanitiza ni escapa un parámetro en su formulario de restablecimiento de contraseña, lo que permite realizar ataques de Cross-Site Scripting Reflejado. Plugins afectados: WPQA history.pushState'', '', '/' Plantill...

CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001

CVE-2025-52691 / WT-2026-0001 SmarterMail Exploit 🚨 IMPORTANT NOTICE This tool is for authorized security testing and educational purposes only! Unauthorized use is illegal and unethical Only use on systems with explicit authorization Use at your own risk Users are responsible for compliance with...

CVE-2024-34327

Comprobador de Vulnerabilidad de Inyección SQL CVE-2024-34327 Este script V-24-02-001SQLiCheck.py es una herramienta prueba de concepto PoC para verificar la presencia de una vulnerabilidad de inyección SQL ciega basada en tiempo que afecta al endpoint password-reset-token.php, identificada como...

CVE-2025-2812

CVE-2025-2812 — SQL Injection Vulnerability in "Bilet Satış Otomasyonu" by Mydata Bilişim Ltd. Şti 📌 CVE-ID: CVE-2025-2812 📢 USOM Announcement: tr-25-0099 🛡️ Vulnerability Type: CWE-89 - SQL Injection Boolean-based Blind 🏢 Affected Product: Bilet Satış Otomasyonu – Mydata Bilişim Ltd. Şti 🌐 Exampl...

CVE-2022-24181

CVE-2022-24181 y CVE-2022-26616. probablemente son iguales Open-journal-system-Vulnerabilidad XSS mediante inyección de Host Header y robo del token de restablecimiento de contraseña de otro usuario Pasos para reproducir: 1. Ir a este sitio: https://who's-using-ojs-software.com 2. Capturar esta...

CVE-2023-7028

CVE-2023-7028 An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be...

CVE-2019-18818

CVE-2019-18818 Usage : url Reference : https://vulners.com/cve/CVE-2019-18818 https://thatsn0tmysite.wordpress.com/2019/11/15/x05/...

CVE_2020_35848

🧨 CVE‑2020‑35848 – Cockpit CMS 0.11.2 NoSQL Injection RCE Lab CVE‑2020‑35848 affects Agentejo Cockpit CMS versions before 0.11.2, introducing a critical NoSQL injection vulnerability in the /auth/newpassword endpoint. This flaw allows unauthenticated attackers to inject MongoDB operators into...

CVE-2024-10508

Unauthenticated Privilege Escalation via Password Recovery on RegistrationMagic = 6.0.2.6 Disclaimer : This information is provided for educational purposes only. This document aims to raise awareness of security vulnerabilities and should not be used for any unauthorized or malicious activities...

CVE-2024-8349-and-CVE-2024-8350

CVE-2024-8349 and CVE-2024-8350 Background information Uncanny Groups for LearnDash uncanny-learndash-group is a third-party plugin for LearnDash LMS sfwd-lms. The plugin lets Group Leaders custom LearnDash role manage users of their own LearnDash groups from the frontend. Group Leaders can add...

CVE-2021-27651

Resumen Un atacante puede omitir todas las etapas del flujo de restablecimiento de contraseña y restablecer la cuenta de cualquier usuario en Pega Infinity. Esto se logra 1 iniciando el flujo de restablecimiento de contraseña e introduciendo el correo electrónico de la víctima, y luego 2 forzando...

CVE-2020-28874

This repository contains the description of the vulnerability found CVE-2020-28874 in ProjectSend r1270 release. Thank you to my colleagues from Entelgy Innotec Security for pushing me to improve! CVE-2020-28874: Privilege Escalation Description The vulnerability is in the reset password componen...

CVE-2024-55591-POC

--port 443 --ssl Then use the prompt: root@kitploit: FortiOS get system status FortiOS exit...

CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Metabase — Unauthenticated SQL Injection → Full Administrator Takeover 📌 Overview CVE-2026-72898 is a maximum-severity CVSS 10.0 unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the...

cve-2020-1472

cve-2020-1472 @toc Vulnerability Principle The principle is relatively complex. If interested, you can check the article at the following link: https://www.freebuf.com/articles/system/249860.html Exploitation 1. Modify the file impacket.dcerpc.v5.nrpc Need to use the...

CVE-2026-8206

CVE-2026-8206 - Exploit Masivo del Plugin Kirki de WordPress Herramienta de explotación masiva para CVE-2026-8206 – una vulnerabilidad crítica en el plugin Kirki de WordPress versiones ≤ 6.0.6 que permite a atacantes no autenticados secuestrar enlaces de restablecimiento de contraseña y tomar el...

ResetNightmare

ResetNightmare Proof-of-concept POC tool for ResetNightmare CVE-2026-27912. ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched...