POC-CVE-2022-30600

Proof of concept per CVE-2022-30600 Panoramica Questo repository contiene 2 implementazioni per un proof of concept che sfrutta CVE-2022-30600. CVE-2022-30600 è una vulnerabilità di sicurezza che consente a un attaccante di bypassare la soglia di blocco dell'account all'interno del webapp moodle...

win-brute-logon

सूचना 1: हमें यह घोषणा करते हुए खुशी हो रही है कि हमारे वर्तमान टूल को PowerShell संस्करण में पोर्ट किया गया है। इसका मतलब है कि उपयोगकर्ता अब PowerShell कमांड लाइन से सीधे टूल तक पहुँच सकते हैं और उसका उपयोग कर सकते हैं, जिससे यह और भी अधिक सुविधाजनक और कुशल हो जाता है। हमारा मानना है कि यह नया...

CVE-2026-82269

Gophish through 0.12.1 has a flaw in its API authentication middleware that fails to enforce account lockout and forced password change policies when a user authenticates with a valid API key. An attacker who already holds a valid API key can retain full API access even after the associated accou...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC della recente vulnerabilità di brute force sulle password di Azure Active Directory scoperta da SecureWorks Descrizione Questo codice è una proof-of-concept della recentemente rivelata vulnerabilità di brute force sulle password di Azure Active Directory annunciata da...

CVE-2020-15931

CVE-2020-15931 Vulnerabilità di divulgazione delle credenziali dell'account amministratore di dominio in Netwrix Account Lockout Examiner 4.1 Panoramica della vulnerabilità Netwrix Account Lockout Examiner ALE precedente alla versione 5.1 consente a un avversario remoto non autenticato di attivar...

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

EUVD-2026-67285

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

CVE-2026-54085

Wazuh (open-source XDR/SIEM platform), versions 4.2.0 through 4.14.6 , contains missing input validation in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands running as root. Five scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c ) omit th...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940 Ebyte NE2-D11 Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

smartbrute

Descrizione Lo strumento intelligente di password spraying e brute force per Active Directory Domain Services. ⚠️ Questo progetto funziona. Ma la codifica approssimativa lo rende più un PoC che uno strumento stabile. Potrei riscriverlo in futuro, ma almeno hai tutto qui per lavorare con il brute...

CVE-2024-10511

CVE-2024-10511 CWE-287: Autenticazione impropria Sommario Il prodotto Schneider Electric PowerChute Serial Shutdown è un software di gestione UPS che consente lo spegnimento ordinato del sistema e funzionalità di gestione dell'energia per desktop, server e workstation. PowerChute Serial Shutdown...

PT-2026-82792

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

Bypass della 2FA tramite attacco di forza bruta Panoramica L'applicazione Nagios Fusion versioni 2024R1.2 e 2024R2 è vulnerabile a un attacco di forza bruta sul meccanismo di autenticazione a due fattori 2FA. In particolare, l'implementazione della 2FA non applica adeguatamente meccanismi di...

CVE-2020-15906

CVE-2020-15906 CVE-2020-15906 的漏洞分析报告。 特别感谢 Frederic Mohr Lastbreach 提供的后端支持。 Tiki Wiki Cms Groupware 16.x - 21.1 认证绕过漏洞 —— Maximilian Barz 发现 我在 TikiWiki Cms Groupware 16.x - 21.1 中发现了一个新漏洞。该漏洞允许远程未经身份验证的攻击者绕过登录页面，从而完全控制 Tiki Wiki CMS。攻击者可以暴力破解管理员账户直至账户被锁定。此后，可以使用空密码以管理员身份进行身份验证并获取访问权限。...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

CVE-2021-3754

CVE-2021-3754 Questo repository documenta i dettagli della vulnerabilità e l'exploit per CVE-2021-3754 scoperta e segnalata da me il 21 agosto 2021. Metriche CWE-20: Validazione dell'input impropria CVSS: 5.3 MEDIO Descrizione È stata trovata una falla in Apache Keycloak e Redhat SSO dove un uten...