CVE-2022-31007-Python-POC

Python automation of the following write up on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0. Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electron...

CVE-2021-3754

CVE-2021-3754 This repository documents Vulnerability details and exploit for CVE-2021-3754 discovered and reported by Anurag Mondal 7Ragnarok7 on 21st August 2021 Metrics CWE-20: Improper Input Validation CVSS: 5.3 MEDIUM Description A flaw was found in Apache Keycloak & Redhat SSO where an...

CVE-2020-15931

CVE-2020-15931 Netwrix Account Lockout Examiner 4.1 Domain Admin Account Credential Disclosure Vulnerability Vulnerbility Overview Netwrix Account Lockout Examiner ALE before 5.1 allows an unauthenticated, remote adversary to trigger a connection to an attacker-controlled system and capture the...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...

smartbrute

Description The smart password spraying and bruteforcing tool for Active Directory Domain Services. ⚠️ This project works. But the filthy coding makes it more PoC than a stable tool. I may or may not rewrite this in the future, but at least you have everything here to work with bruteforce on any...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

POC-CVE-2022-30600

Proof of concept for CVE-2022-30600 Overview This repository contains 2 implementations for a proof of concept which exploits CVE-2022-30600. CVE-2022-30600 is a security vulnerability which allows an attacker to bypass the account lockout threshold within the moodle webapp. As outlined by the...

win-brute-logon

Notice 1: We are excited to announce that our current tool has been ported to a PowerShell version. This means that users can now access and use the tool directly from the PowerShell command line, making it even more convenient and efficient to use. We believe that this new version will greatly...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

MSF_PassSpray_Wordlist_Generator

Password Spray Wordlist Generator A handy tool that helps you to create your own wordlist for Metasploit framework, in order to carry out a password spray attack against various network protocols in your victims' domain, such as SMB : Description Metasploit has multiple modules that can be utiliz...

CVE-2026-35161

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-35161

Dell PowerScale InsightIQ , versions 5.2.0 through 6.3.0 , is affected by an Overly Restrictive Account Lockout Mechanism vulnerability (CWE-645). An unauthenticated attacker with remote access could exploit this flaw to cause a Denial of Service (DoS) . Documentation regarding specific exploit a...

CVE-2026-35161

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-35161

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

EUVD-2026-101033

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

CVE-2026-109371

The ZITADEL identity platform versions 3.0.0 before 4.18.0 is vulnerable to a missing authentication flaw in the hosted Login V1 UI . The root cause is that the change-username handler processes account modifications before verifying any authentication factors. This allows unauthenticated attacke...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2020-15906

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Frederic MohrLastbreach for your Backend Support. Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated...

CVE-2026-109371: Missing Authentication for Critical Function

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...