cve-2019-17240

Bludit = 3.9.22 - 暴力破解缓解绕过 这是一个小项目，我将这个Python脚本重写为Go语言。该项目的目的是学习Go语言并理解这个漏洞利用的工作原理。 用法 $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of ./brutepass: -c int Threads default 5 default 5 -l string Hostname eg... http://127.0.0.1/admin/login.php -p string Password file -u string...

subbrute

サブドメインブルートフォーサー SubBrute SubBrute はコミュニティ主導のプロジェクトであり、最速かつ最も正確なサブドメイン列挙ツールを目指しています。SubBrute の特別な点は、公開リゾルバを一種のプロキシとして使用し、DNS レート制限を回避することです（https://www.us-cert.gov/ncas/alerts/TA13-088A）。この設計により、SubBrute はターゲットのネームサーバーに直接トラフィックを送信しないため、匿名性の層も提供します。 v2.1 の新機能 安定性の向上。Cloudflare ドメインのテストサポートの改善。...

CVE-2019-19633

CVE-2019-19633 Chevereto 1.0.0～1.1.4 Free版、および3.13.5 Core版の lib/G/functions.php では、攻撃者がリクエスト内の X-Forwarded-For ヘッダーを操作することで、実装された保護メカニズムを発動させずにブルートフォース攻撃を実行することができます。ヘッダー内のIPは25リクエスト（デフォルトは25）ごとに変更する必要があり、それにより保護が作動してIPがブロックされるのを防ぎます（実際にはブロックされても問題になりませんが）。 最初の25回のリクエスト X-Forwarded-For: 8.8.8.1,...

CVE-2025-61560

A race condition vulnerability exists in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 . This flaw allows attackers to bypass rate limiting mechanisms by sending repeated crafted requests, which can be used to facilitate a brute force attack . No specific remediatio...

EUVD-2025-211059

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE_2023_44487-Rapid_Reset

CVE-2023-44487 HTTP/2 Rapid Reset テストツール - 拡張版 CVE-2023-44487 （HTTP/2 Rapid Reset 脆弱性）のための包括的な Python テストツールです。この拡張版では、テストパラメータの詳細な制御、複数の攻撃パターン、高度な監視機能を提供します。 ⚠️ 重要なお知らせ このツールは教育目的および許可を得たテスト専用です！ 自分が所有するシステム、または明示的な書面による許可を得たシステムに対してのみ使用してください 無許可での使用は違法となる可能性があり、サービス障害を引き起こす恐れがあります...

CVE-2020-35590

エクスプロイト情報 エクスプロイトタイトル: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - ログイン制限バイパス CVE: CVE-2020-35590 日付: 2020-06-09 エクスプロイト作成者: N4nj0 ソフトウェアリンク: https://wordpress.org/plugins/limit-login-attempts-reloaded/ バージョン: 2.13.0 テスト環境: WordPress 5.4.1, 5.4.2 脆弱性勧告:...

CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

EUVD-2026-92476

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

Rate Limiting Bypass

Apache Qpid Broker-J is vulnerable to Rate Limiting Bypass. The vulnerability is due to the broker's inability to govern the rate at which it responds to an echo flow, where the response handling lacks proper throttling and an authenticated attacker can trigger excessive resource usage leading to...

PT-2026-105101

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-100678

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...

CVE-2026-100678

Versions of stoatchat prior to 0.15.5 are vulnerable to MFA brute-forcing because they fail to enforce account-level attempt limits on MFA login challenges. While IP-based rate limiting is present, attackers who already possess a valid password can bypass these restrictions by reusing MFA challen...

EUVD-2026-87651

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...

CVE-2026-100600

The ClawHub (openclaw/clawhub application/backend) application is vulnerable to quota exhaustion because anonymous HTTP API requests are not bound to a trusted caller identity. This allows a remote, unauthenticated caller to drain a shared default quota, potentially denying or degrading API acces...

PT-2026-99349

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description Insufficient enforcement of account-level attempt limits during MFA login challenges allows attackers with a valid password to guess TOTP Time-based One-Time Password codes. Because rate limiting ...

CVE-2026-84461

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even...

PT-2026-97156

Name of the Vulnerable Software and Affected Versions divi-dash WordPress plugin versions prior to 1.0.7 Description The plugin fails to validate the source of the client IP address used for rate limiting and banning. This allows unauthenticated attackers to spoof arbitrary IP addresses to bypass...

PT-2026-96821

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description In deployments where requests reach Next.js without the sanitizing custom-server.js wrapper, the application uses the client-supplied X-9r-Real-Ip header as the bucket key for rate limiting. This...

EUVD-2026-81053

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...