credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

munge

MUNGE Uid 'N' Gid Emporium MUNGE（ MUNGE Uid 'N' Gid Emporium ）是一种用于创建和验证用户凭据的身份验证服务。它被设计为具有高度可扩展性，适用于 HPC 集群环境。它提供了一个可移植的 API，用于将用户身份编码为防篡改的凭据，该凭据可以由不受信任的客户端获取，并由安全域内不受信任的中介转发。该域内的客户端无需使用 root 权限、保留端口或平台特定的方法即可创建和验证凭据。 概述 安装指南 许可证信息 手册页 验证发布...

CVE-2021-46363

CVE-2021-46363: Magnolia CMS 中的公式注入 Magnolia v6.2.3 及以下版本的导出功能存在一个缺陷，允许攻击者通过精心构造的 CSV/XLS 文件执行公式注入攻击。当受害者使用 Microsoft Excel 打开导出的文件时，这些公式可能导致任意代码执行。 厂商披露： 该漏洞的厂商披露和修复可在此处找到此处。 要求： 此漏洞需要： 有效的用户凭证 概念验证： 更多细节和利用过程可参见此PDF。...

WSO2-2020-0731

WSO2-2020-0731: WSO2 Carbon 中的 XXE 和 XSS 漏洞 已在多个 WSO2 产品中发现潜在的 XXE 和 XSS 漏洞。 厂商披露： 此漏洞的厂商披露和修复可在此处找到。 为什么没有 CVE？ 我和厂商都没有为这些漏洞申请 CVE。 要求： 此漏洞需要： 诱使合法的 WSO2 用户添加恶意仓库 或 有效的用户凭据 概念验证： 更多详情和利用过程可在此 PDF 中找到。...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

Uniview IP Cameras Improper Authentication (CVE-2023-0773)

Some Uniview IPC products have an access control vulnerability in their web-based management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to modify device user credentials. Successful exploitation of this vulnerability could allow the attacker to gain...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2025-70829

CVE-2025-70829: Datart における情報漏洩 中文文档 1. 脆弱性の概要 CVE ID : CVE-2025-70829 製品 : Datart バージョン : v1.0.0-rc.3 脆弱性タイプ : 情報漏洩 Datart v1.0.0-rc.3 における情報漏洩の脆弱性により、認証済みの攻撃者はカスタム H2 JDBC 接続文字列を介して機密データにアクセスできます。アプリケーションを自身の内部データベースファイルに接続させることで、攻撃者はユーザー資格情報や構成詳細を含むシステムテーブルにクエリを実行できます。 2. 再現手順 前提条件 Datart...

PT-2026-95827

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The endpoint used for deleting user credentials fails to correctly verify fine-grained reset-password permissions. This allows a delegated...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-27548

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...