desktop-2fa

🛡️ Desktop-2FA A secure, offline two-factor authentication 2FA manager for desktop environments. Built with Python, featuring strong encryption and no cloud dependencies. 🌐 Landing Page : desktop-2fa.org ✨ Features...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Bypass MFA WordPress - Exploit Lab This repository provides a lab for exploiting the CVE-2024-10924 vulnerability in WordPress, specifically to bypass two-factor authentication MFA and gain access to the WordPress administration panel. Prerequisites To deploy this lab in your...

Aegis

Aegis Authenticator Aegis Authenticator 是一款免费、安全且开源的 Android 2FA 应用。它旨在为你的在线服务提供安全的验证器，同时包含现有验证器应用所缺失的一些功能，如完善的加密和备份。Aegis 支持 HOTP 和 TOTP，可兼容数千种服务。 如需常见问题列表，请查看 FAQ。 应用的安全设计及保险库格式在 此文档 中有详细描述。 特性 免费且开源 安全 保险库已加密（AES-256-GCM），可通过以下方式解锁： 密码（scrypt） 生物识别（Android Keystore） 防止屏幕截图 点击显示 兼容 Google...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

WordPress miniOrange 2FA plugin 18.0-19.2 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

CVE-2024-10924

CVE-2024-10924 漏洞利用 WordPress Really Simple Security 插件 - 身份验证绕过 📌 概述 CVE-2024-10924 是一个关键的身份验证绕过漏洞，存在于 WordPress 的 Really Simple Security 插件中（版本 9.0.0 到 9.1.1.1）。该漏洞允许未经身份验证的攻击者通过利用双因素认证（2FA）API 中的缺陷，以任何用户（包括管理员）身份登录。 CVE 编号: CVE-2024-10924 严重程度: 🔥 严重 CVSS 9.8 受影响版本: Really Simple Security 9.0.0...

EUVD-2026-75445

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

PT-2026-89406

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

EUVD-2026-72858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by an authentication bypass rooted in its SQL data layer: sqlDAL caches empty result sets that writeSql never invalidates. As a result, when a user attempts two-factor authentication on a new device, the confirmation code ...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application 这是一个用于测试Really Simple Security 9.1.2 身份验证绕过漏洞（CVE-2024-10924）的易受攻击的应用程序。 警告！ 此应用程序包含严重安全漏洞。运行风险自负！建议使用已备份且隔离的环境（例如具有最近快照和仅主机网络的虚拟机）。请勿将此应用程序上传到任何面向互联网的服务器，否则将会被入侵。 免责声明 ：我不对任何人使用此应用程序的方式负责。此应用程序的唯一目的是为Really Simple Security 9.1....

Aegis v3.4.3

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit This is a Python3 program that exploits Really Simple Security 9.1.2 authentication bypass vulnerability CVE-2024-10924. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security（免费版、专业版及专业版多站点）9.0.0 - 9.1.1.1 - 身份验证绕过 📖 描述 该脚本利用了 WordPress 的 Really Simple Security 插件（9.0.0 - 9.1.1.1 版本）中的一个漏洞。该缺陷源于双因素认证 API 中 checkloginandgetuser 函数对错误处理不当，从而允许绕过身份验证。 利用此漏洞，攻击者可在启用双因素认证（2FA）的情况下以任意用户（例如管理员）身份登录。一旦认证成功，脚本便会使用获取到的会话 Cookie...

EUVD-2026-71013

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

BIT-JOOMLA-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...