CVE-2024-41276

CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...

requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

xmlrpc-brute

WordPress XML-RPC Bruteforce Tool A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface. Description This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standar...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

CVE-2016-16113-POC

Get RCE - Bludit CMS Exploit | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| An automated exploitation tool that combines CVE-2019-17240 Authentication Bypass and CVE-2019-16113 Arbitrary File Upload to achieve remote code execution on...

CVE-2014-0195

Script de Explotación de Fuerza Bruta XML-RPC para WordPress Este repositorio contiene una prueba de concepto PoC basada en Python para realizar ataques de fuerza bruta a credenciales de inicio de sesión en instancias de WordPress vulnerables a CVE-2014-0195, donde la función system.multicall de...

CVE-2024-25277

CVE-2024-25277 discovered on MW45APT02.0002 Resources and PoCs This repo serves as collection of scripts and PoCs gathered during analysis and discovery of CVE-2024-25277. You can read more about the finding on:...

cve-2026-8697

CVE-2026-8697: Login Rate Limit Bypass on TP-Link Archer C64 CVE-2026-8697 is a logic flaw in the TP-Link Archer C64's OS called TPOS in the debug message. It lets any unprivileged user connected to the router to bypass the web UI rate limit by using a residual SSH service. A simple Python script...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descripción : Omisión del límite de peticiones que conduce a la omisión de 2FA Versión probada : 2.7.0 Tipo de ataque: Remoto Impacto : Omisión de 2FA Proveedor del producto : https://www.discourse.org Información adicional : Discourse es una plataforma de...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

WordPress wpForo Forum plugin 3.0.0-3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability

Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability discovered by Usama Arshad in WordPress Plugin wpForo Forum versions 3.0.0-3.1.5...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514

The wpForo Forum WordPress plugin (versions 3.0.0 through 3.1.5 ) is vulnerable to unauthenticated AI credit exhaustion . The root cause is a failure to verify the source of client-supplied IP address headers, which are used to key the per-visitor rate limit on paid AI requests. An attacker can b...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

EUVD-2026-86626

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass del límite de tasa por alias en GraphQL Batching Código del programa exploit en Node.js + Python // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema =...

goop

goop Raspador de Búsqueda de Google Nota: Ya no funciona. El equipo de Google me dijo que no era un problema legítimo cuando lo reporté, pero ahora simplemente lo arreglaron silenciosamente. Contenido Introducción ¿Cómo funciona? Uso Instalación Ejemplo Legal y Descargo de Responsabilidad...