cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Critical Authentication Bypass via CRLF Injection in cPanel/WHM cpsrvd Daemon 📋 Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM that allows unauthenticated remote attackers to gain root-level...

infisical

The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Community | Infisical Cloud | Self-Hosting | Docs | Website | X | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams use...

Discuz-X5.0-Authentication-Bypass-Exploit-Framework

Discuz! X5.0 Authentication Bypass Exploit Framework ⚡ CVE-2026-49952 | CVSS 9.1 Critical | Version 1.0.0 A professional penetration testing tool designed to identify and demonstrate the critical authentication bypass vulnerability in Discuz! X5.0. 📋 Table of Contents ⚠️ Disclaimer 🔍 Overview 🎯...

CVE-2026-31282

CVE-2026-31282 Description Totara LMS is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form and bypass Octa login. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack to obtain a user credentials...

CVE-2026-41940

⚠️ CVE-2026-41940 - cPanel & WHM Authentication Bypass Critical Pre-Authentication Bypass in cPanel & WHM 📌 Overview CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM and WP Squared. An unauthenticated remote attacker can completely bypass login and gain full...

CVE-2026-33340

CVE-2026-33340: SSRF in lollms-webui Overview Field| Detail ---|--- CVE ID| CVE-2026-33340 Vulnerability| Server-Side Request Forgery SSRF Affected Product| ParisNeo/lollms-webui LoLLMs WEBUI Severity| Critical — CVSS 9.1 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918:...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...

CVE-2026-21962

🚨 CVE-2026-21962 - Critical Authentication Bypass Vulnerability 🧾 Summary 🔥 A maximum severity 10.0 vulnerability enabling unauthenticated remote access to Oracle middleware systems. CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass CWE : CWE-284...

CVE-2026-41462

🚨 CVE-2026-41462 - ProjeQtor Unauthenticated SQL Injection Critical Unauthenticated SQL Injection in ProjeQtor ≤ 12.4.3 📌 Overview CVE-2026-41462 is a critical unauthenticated SQL Injection vulnerability in the login functionality of the ProjeQtor project management tool. CVE ID : CVE-2026-41462...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

CVE-2026-16540-SimplyScheduleAppointments

CVE-2026-16540 — Simply Schedule Appointments 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint Field| Details ---|--- CVE| CVE-2026-16540 Plugin| Simply Schedule Appointments Affected Versions| 1.6.12.6 Fixed In| 1.6.12.6 Active Installs| 70,000 CVSS 3.1|...

CVE-2026-9703

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-95180

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

CVE-2026-9490

CVE ID: CVE-2026-9490 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19668 1. Executive Summary A critical security vulnerability has been identified in the Acer Care Center service ACCSvc.exe. The vulnerability allows any authenticated local user to...

unauthscout

UnauthScout UnauthScout is a CLI tool for unauthenticated OSINT reconnaissance on public developer platforms such as GitHub and GitLab. It standardizes the collection of publicly available user data using a consistent interface and normalized JSON output contracts. Problem Statement Public...

wordpress-skelersecurity-core-security-CVE-2026-63030

SkelerSecurity Core Security Plugin A focused, temporary mitigation for unauthenticated access to WordPress Core’s REST Batch API endpoint. Overview SkelerSecurity Core Security Plugin requires authentication before WordPress processes requests to the Core REST Batch API route: /wp-json/batch/v1...

CVE-2025-67160

CVE-2025-67160 — Vatilon-based IP Cameras Summary Vatilon-based IP camera firmware exposes multiple internal web directories without requiring authentication. When directory indexing is enabled on the embedded web server, unauthenticated attackers can access directories such as /cgi-bin/, /view/,...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...

CVE-2020-11651

CVE-2020-11651 PoC for CVE-2020-11651 Requires Python3 tested on 3.8 python3.8 -m pip install pyzmq msgpack ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host optional...