CVE-2024-10924

CVE-2024-10924 のエクスプロイト WordPress Really Simple Security プラグイン - 認証バイパス 📌 概要 CVE-2024-10924 は、WordPress 用 Really Simple Security プラグイン バージョン 9.0.0 から 9.1.1.1 における重大な認証バイパスの脆弱性です。この脆弱性により、未認証の攻撃者は二要素認証 2FA API の欠陥を悪用して、任意のユーザー 管理者を含む としてログインできます。 CVE ID: CVE-2024-10924 深刻度: 🔥 Critical CVSS 9.8...

CVE-2022-40470

CVE-2022-40470 CodeIgniter を使用した血液ドナー管理システムにおけるクロスサイトスクリプティング - 1.0 推奨される説明 Phpgurukul Blood Donor Management System 1.0 では、血液型名の追加機能を介して クロスサイトスクリプティングが許可されています。 追加情報 PoC: https://drive.google.com/file/d/1UDuez2CTscdWXYzyXLi3x8CMs9IWLL11/view?usp=sharing 脆弱性タイプ クロスサイトスクリプティング XSS 製品ベンダー Phpguruk...

Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

CVE-2023-7172

CVE-2023-7172 概述 本项目包含一个存在漏洞的医院管理系统（HMS）版本，该系统容易受到 SQL 注入（CVE-2023-7172）攻击。SQL 注入是一种严重的 Web 应用程序漏洞，可能对系统的安全性和功能造成严重影响。 CVE 详情 CVE ID： CVE-2023-7172 漏洞类型： SQL 注入 受影响组件： 管理员登录页面 易受攻击的参数： username 供应商详情： phpgurukul.com 受影响版本： 医院管理系统 1.0 复现步骤（PoC） 克隆仓库： root@kitploit: git clone...

Breacher

Breacher 管理画面のログインページとEAR脆弱性を見つけるスクリプト 特徴 オンデマンドのマルチスレッド 大規模なパスリスト（482パス） php、asp、htmlの拡張子に対応 潜在的なEAR脆弱性をチェック robots.txtをチェック カスタムパスのサポート 使用方法 php拡張子で全パスをチェック root@kitploit: python breacher -u example.com --type php php拡張子の全パスをスレッドでチェック root@kitploit: python breacher -u example.com --type php...

CVE-2024-9933

CVE-2024-9933 WatchTowerHQ = 3.10.1 - 빈 값 확인 누락으로 인한 관리자 인증 우회 설명: WatchTowerHQ 워드프레스 플러그인은 3.9.6까지의 버전에서 인증 우회 취약점에 노출됩니다. 이는 'watchtowerotatoken'의 기본값이 비어 있고, 'PasswordLessAccess::login' 함수에 값이 비어 있지 않은지 확인하는 검사가 누락되었기 때문입니다. 이로 인해 인증되지 않은 공격자가 WatchTowerHQ 클라이언트 관리자 사용자로 로그인할 수 있습니다...

CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---重大な認証バイパス- CVE-2025-41646 - 重大な認証バイパス 🔓 CVE-2025-41646 - RevPi WebStatus 認証バイパス PoC RevPi WebStatus ≤ v2.4.5 における重大な認証バイパス脆弱性（CVE-2025-41646）により、攻撃者は弱い型比較ロジック（== vs ===）のため、有効な認証情報なしで admin としてログインできます。 📌 影響を受けるバージョン RevPi WebStatus v2.4.5 以下 Apache を使用して Raspbian 上で動作する産業用/OT シス...

ABO.CMS-Login-SQLi-CVE-2024-25227

ABO.CMS-Login-SQLi-CVE-2024-25227 未認証SQLiおよびログインバイパス CVE-2024-25227 日付: 23/02/2024 テスト対象: ABO.CMS 5.8 ベンダー: ABO.CMS ベンダーURL:https://abocms.ru ABO.CMS 5.8は、管理者ログインページのtbloginパラメータを介したSQLインジェクションに対して脆弱です。 影響を受けるコンポーネントは、管理者ログインページの「tblogin」パラメータです 他のエディションでも脆弱である可能性があります...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - i-doit Pro 25 이하 버전의 하드코딩된 관리자 자격 증명 i-doit Pro 25 이하 버전은 하드코딩된 관리자 자격 증명 취약점에 노출됩니다. 이 취약점으로 인해 누구나 사용자 이름 “admin”과 비밀번호 “admin”만으로 관리자로 로그인할 수 있습니다. 제품 설명: i-doit은 synetics GmbH가 개발한 웹 기반 오픈소스 IT 문서화 및 CMDBConfiguration Management Database입니다. i-doit Pro는 이 소프트웨어의 상용 버전으로 유료...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — 在 PerfexCRM 注意：以上步骤是 Ajansha Shankar 和 Ahamed Yaseen 报告的原始发现步骤。 参考资料 OWASP 身份验证备忘单 — 关于服务器端验证和身份验证控制的指南。 https://cheatsheetseries.owasp.org/cheatsheets/AuthenticationCheatSheet.html 缓解措施 / 推荐修复方案 对身份验证参数实施严格的服务器端验证。拒绝缺少或为空的用户名/密码请求，并返回适当的 4xx 响应。...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - bypass bruteforce - CVE-2019-17240 Script molto semplice basato su CVE-2019-17240. POC originale e spiegazione: https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-78246

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

EUVD-2026-64828

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246 itsourcecode Online Clinic Management System Admin Login login.php sql injection

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246

A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 , specifically in the Admin Login component (file success/login.php). The root cause is the unsanitized handling of the Username argument, allowing an unauthenticated remote attacker to inject arbitrary SQL. ...

PT-2026-80808

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0 Description An issue in the Admin Login component allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. T...

CVE-2026-76764

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764 code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...