CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---Critical-Authentication-Bypass- CVE-2025-41646 - Critical Authentication bypass 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC A critical authentication bypass vulnerability CVE-2025-41646 in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as admin without val...

Breacher

Breacher A script to find admin login pages and EAR vulnerabilites. Features Multi-threading on demand Big path list 482 paths Supports php, asp and html extensions Checks for potential EAR vulnerabilites Checks for robots.txt Support for custom patns Usages Check all paths with php extension...

CVE-2022-40470

CVE-2022-40470 Cross Site Scripting in Blood Donor Management System Using CodeIgniter - 1.0 Suggested description Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. Additional Information PoC:...

Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - Hardcoded Admin Credential in i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to Hardcoded admin credential vulnerability. These vulnerabilities could allows anyone to login as admin with just username “admin” and password “admin”. Description of product: i-doit is...

CVE-2023-7172

CVE-2023-7172 Overview This project contains a vulnerable version of a Hospital Management System HMS that is susceptible to SQL Injection CVE-2023-7172. SQL Injection is a critical web application vulnerability that can have severe impacts on the security and functionality of a system. CVE Detai...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240 Very simple script based on CVE-2019-17240. Original POC and explanation: https://github.com/bludit/bludit/pull/1090. usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p...

CVE-2024-10924

Exploit for CVE-2024-10924 WordPress Really Simple Security Plugin - Authentication Bypass 📌 Overview CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security plugin for WordPress versions 9.0.0 to 9.1.1.1. This vulnerability allows unauthenticated attackers ...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

CVE-2026-128332

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, eac...

CVE-2026-128332 listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, eac...

CVE-2026-128332

The listmonk application (versions 6.0.0 before 7.0.0-beta.2) is vulnerable to a 2FA bypass via TOTP brute-forcing at the /admin/login/twofa endpoint. The root cause is that the attempt counter resets on every new password login. An attacker with a valid password can repeatedly submit credentials...

EUVD-2026-125045

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, eac...

CVE-2026-128332 listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, eac...

CVE-2024-9933

CVE-2024-9933 WatchTowerHQ = 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check Description: The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtowerotatoken' default value is...

PT-2026-146546

Name of the Vulnerable Software and Affected Versions Listmonk versions 6.0.0 through 7.0.0-beta.1 Description A 2FA bypass exists that allows attackers possessing a valid password to brute-force Time-based One-Time Password TOTP codes. This occurs because the attempt counter resets every time a...

CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM Note: Steps above are the original discovery steps reported by Ajansha Shankar and Ahamed Yaseen. References OWASP Authentication Cheat Sheet — gui...

ABO.CMS-Login-SQLi-CVE-2024-25227

ABO.CMS-Login-SQLi-CVE-2024-25227 Unauthenticated SQLi and Login Bypass CVE-2024-25227 Date: 23/02/2024 Tested on ABO.CMS 5.8 Vendor: ABO.CMS Vendor URL:https://abocms.ru ABO.CMS 5.8 is vulnerable to SQL Injection via the tblogin parameter, admin login page. The affected component is "tblogin"...

CVE-2026-124575

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

CVE-2026-124575

A vulnerability exists in SiteServer SSCMS versions up to 7.1.3, 7.2.1, and 7.4.0. The flaw resides in the Admin-Login CAPTCHA component, specifically within the LoginController.Submit function located in src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs. Manipulation of the isForceLogout...