SMSBotBypass

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

Starlink-FI

Starlink User Terminal Modchip This repository accompanies the talk titled "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal". A slide deck is available here, a recording of the talk should be available soon. The talk covers how we managed to execu...

AVTECH DVR - Login Verification Code Bypass

AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...

gosign-desktop-exploit-poc

Multiple Vulnerabilities in GoSign Desktop leads to Remote Code Execution Name: TLS Verification Bypass and Insecure Update in GoSign Desktop CVEs: CVE-2025-34324, CVE-2025-34327 System Affected: GoSign Desktop = 2.4.0 Fix: FoSign Desktop 2.4.1 partially fixed Vendor: Tinexta InfoCert S.p.A...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow Disclosure Date: 2025-06-11 Vendor fix date per vendor: 2025-06-13 Researcher validation date: 2025-06-26 Discovered by: Sneden Rebello Summary A legacy user creation API pathway allowed accounts to be created without...

otp-bot

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

CVE-2020-10759-poc

Summary Exploits CVE-2020-10759 - fwupd PGP signature verification bypass. See https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md for more details. Requirements Note: You need to install python3-gpg from your OS vendor...

CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-

CVE-2026-8080 – DKIM Signature Verification Bypass Header Canonicalization Flaw Program Code Python email parsing simulation dkimverifiersim.py - Flawed DKIM verifier import re, hashlib Simulated email with DKIM signature rawemail = b"""From: [email protected] To: [email protected]...

CVE-2026-96760

CVE-2026-96760 - Authlib JWS Signature Verification Bypass PoC Proof-of-concept for a signature verification bypass in Authlib's authlib.jose module. JsonWebSignature.deserializejson accepts a General JSON JWS object with an empty signatures array and returns the attacker-controlled payload as...

CVE-2026-128037 gittuf: Policy rules bypassed in the presence of global rules

In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not...

CVE-2026-128037

The gittuf tool versions 0.10.0 through 0.15.0 contains an incorrect authorization vulnerability (CWE-863). When a minimum threshold global rule and a policy rule protect the same namespace, the system incorrectly prioritizes the global rule's check over the policy rule's specific authorized user...

CVE-2026-128034 gittuf: File protection rules bypassed for filenames with special characters

In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters for example non-ASCII characters instead of the raw paths. Such paths do not match patterns like file:internal/, so the files are treated ...

CVE-2026-128034

The gittuf tool (versions before 0.18.0 ) contains a vulnerability where file protection rules can be bypassed. The root cause is that the application verifies protection rules using quoted, escaped pathnames provided by Git for files with special characters (such as non-ASCII characters) instead...

epson-eh-tw5350-advisories

Epson EH-TW5350 — CVE-2021-43716, CVE-2021-43717, CVE-2021-43718 Three vulnerabilities discovered in the Epson EH-TW5350 projector firmware 150075647YWWV110 by team B-BEAM-BOB during the KITRI Best of the Best BoB program, 2021. CVE IDs were assigned by MITRE on 2021-12-21 but the records remaine...

CVE-2026-6274

CVE-2026-6274: Redline WR3200 Authentication Bypass English | Turkish This repository contains the technical details and Proof of Concept PoC for CVE-2026-6274. The vulnerability exists in Redline WR3200 routers prior to firmware v7.1.8 and allows an attacker to bypass authentication and change t...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

CVE-2026-85248

CVE-2026-85248 — camel-pqc: concurrent Signature race signature verification bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PQC producer held a singlejava.security.Signature instance and used it for every exchange without synchronization. Signature is...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2025-56224

CVE-2025-56224 OTP verification Bypass Description an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code. CVSS Score: 8.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yaza...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...