Wincrash

Wincrash root@kitploit: I'm not responsible for what you use this to accomplish and should only be used for education purposes. CVE-2019-0708 - when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code...

Unauthenticated-CVE-2020-0796-PoC

Unauthenticated CVE-2020-0796 Proof-of-Concept All the proofs-of-concept scripts I've seen at this point have required both a username and a password. Therefore I decided to post my own PoC. It's nothing fancy, but it works. It doesn't require any additional modules and works with Python 3. Usage...

CVE-2026-90780

SIPp through 3.7.7 contains a buffer overflow in the get_header() function within src/sip_parser.cpp. When processing SIP messages whose header content exceeds 20,490 bytes , an unauthenticated remote attacker can overflow a static buffer and crash the process , resulting in denial of service. Th...

CVE-2023-40459

CVE-2023-40459 CVE-2023-40459 Unauthenticated DoS PoC Exploit. this vulnerability affects the ACEManager component of ALEOS 4.16 and earlier, a product of Sierra Wireless. Usage python3 PoC-CVE-2023-40459.py Address: http://target Port: 9091 Refrence NVD Article Double Take Zero Day...

CVE-2026-67184-Unauthenticated-NULL-Pointer-Dereference-Crashes-the-Server-TinyWeb-

Aviso de seguridad: La desreferencia de puntero NULL no autenticada provoca el bloqueo del servidor TinyWeb ID de CVE asignado: CVE-2026-67184 Resumen Cuando TinyWeb no puede analizar una línea de solicitud, devuelve un error pero deja el puntero URL de la solicitud establecido en NULL. El llamad...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

EUVD-2026-76853

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-25075-check

CVE-2026-25075 Vulnerability Assessment Tool Safely detect whether a strongSwan VPN server is vulnerable to CVE-2026-25075 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-25075 is an integer underflow vulnerability in strongSwan's EAP-TTLS plugin...

EUVD-2026-75170

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout...

EUVD-2026-74281

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint...

CVE-2026-88286

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

EUVD-2026-75325

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

EUVD-2026-75324

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

CVE-2026-38361

CVE-2026-38361: Múltiples vulnerabilidades de DoS no autenticadas en dash-uploader...

dlink-dir-819-dos

CVE-2022-40946 Exploit: Unauthenticated Denial of Service in DLink consumer DIR 819 A1 routers Exploit Fetch the sources root@kitploit: $ git clone https://github.com/whokilleddb/dlink-dir-819-dos $ cd dlink-dir-819-dos $ pip install -r requirements.txt Run the exploit root@kitploit: $ ./exploit....

CVE-2026-26235-JUNG-Smart-Visu-Server-Unauthenticated-Reboot-Shutdown

👤 Author Mohammed Idrees Banyamer 📍 Country: Jordan 📸 Instagram: @banyamersecurity Proof-of-Concept exploit for CVE-2026-26235 - Unauthenticated Denial of Service via missing authentication in JUNG Smart Visu Server ≤ 1.1.1050. 🚨 Vulnerability Description CVE-2026-26235 is an unauthenticated...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by multiple vulnerabilities : - RouterOS accepts a 'related' btest connection before...

PT-2026-89681

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...

CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...