917 matches found
CVE-2017-13872-Patch
CVE-2017-13872-Patch Download this software and execute it then it request you new password for root user. The password could be different, but i think, in the default option, is equal to Admin password. Update You can correct the bug upgrading your OS...
CVE-2022-0847
CVE-2022-0847 exploit de CVE-2022-0847 que elimina directamente la contraseña de la cuenta root Uso: 1. gcc cve-2022-0847.c -o exploit 2. ./exploit Requisitos: gcc Resumen del trabajo: El clásico exploit POC tradicional de Max Kellermann se usaba para añadir un usuario con privilegios root, pero ...
CVE-2024-25832-PoC
CVE-2024-25830 和 CVE-2024-25832 - DataCube3 不当访问控制与无限制文件上传。 概述 本仓库提供了一个针对 DataCube3 设备的两步利用链概念验证（PoC）。它结合了 CVE-2024-25830（不当访问控制）来提取 root 密码，以及 CVE-2024-25832（无限制文件上传）来部署反向 Shell 脚本。该 PoC 补充了博文“DataCube3 漏洞报告”中的详细漏洞分析。 受影响版本 所有 F-logic DataCube3 设备版本 1.0。 PoC 脚本用法 root@kitploit: Usage: python...
CVE-2023-28432
CVE-2023-28432 MinIO Information Disclosure Leaks Account Passwords The MinIO system has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all sensitive information, including MINIOSECRETKEY and MINIOROOTPASSWORD, by sending a specially crafted POST request to...
CVE-2026-41940
CVE-2026-41940 — Herramienta de investigación de omisión de autenticación de WHM/cPanel Este repositorio contiene un script de Prueba de Concepto PoC basado en la cadena de omisión de autenticación de cPanel/WHM a través de la cookie whostmgrsession y cabeceras HTTP. El script cambia la contraseñ...
CVE-2026-41940
CVE-2026-41940 – Bypass de Autenticación cPanel/WHM + Cambiador de Contraseña Root Este script explota la vulnerabilidad de bypass de autenticación en cPanel/WHM CVE-2026-41940 mediante una técnica de inyección CRLF para falsificar una sesión de administrador. Tras el éxito, el script puede cambi...
CVE-2026-66408
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...
CVE-2026-66408
CVE-2026-66408 affects the DEEBOT PRO M1 and DEEBOT PRO K1VAC: the root accounts are configured with weak passwords. A user with physical access can obtain the root password, enabling privileged action on the device. The CVSS metrics indicate a physical attack with low complexity, but high confid...
CVE-2026-49005
The root password hash of the device can be obtained through unencrypted information in the firmware...
CVE-2026-49005
CVE-2026-49005 affects ZTE F689 devices, where the root password hash can be obtained from unencrypted firmware information. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields a LOW base score (2.4), indicating limited impact to confidentiality. The description confirms leakage of t...
EUVD-2026-54357
The root password hash of the device can be obtained through unencrypted information in the firmware...
CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product
The root password hash of the device can be obtained through unencrypted information in the firmware...
Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App
Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...
CVE-2026-67594
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...
CVE-2026-67594 Spikster Missing Authentication via API Route Group
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...
PYSEC-2026-2003 vantage6 has insecure SSH configuration for node and server containers
Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...
CVE-2026-55740 SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter
Nur-Alam39 bus-ticket no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad contains an unauthenticated SQL injection vulnerability in businfo.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query select from businfo where id= without...
CVE-2026-54445 Vantage6: Set admin user and password from environment or configuration
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username root and password root. This is not ideal because attackers know that almost all vantage6 servers have a user with username root that probably has admin rights,...
CVE-2026-40425
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password...