CVE-2026-52824

CVE-2026-52824: Kimai Default APPSECRET Login Link Forgery Field| Value ---|--- CVE| CVE-2026-52824 Advisory| GHSA-jr9p-4h4j-6c58 Severity| Critical CWE| CWE-1188, Initialization of a Resource with an Insecure Default Affected| kimai/kimai = 2.57.0 Fixed| 2.58.0 Advisory published| 2026-06-11 Add...

GEVAUDAN

GEVAUDAN Gluster Environment Vulnerable AUthentication Data Access & Nuke. Getting Started Gevaudan is a Red Hat GlusterFS exploit for CVEs 2018-1088 & 2018-1112. Available in both standalone and metasploit module formats. Presentations | Date| Conference| Link to Video| Link to Slides...

CVE-2021-36394-Pre-Auth-RCE-in-Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Vulnerability Introduction Moodle is the most popular learning management system in the world. Start creating your eLearning website in minutes! An unauthorized remote code execution vulnerability exists in the Shibboleth authentication module of Moodle. This...

CVE-2018-15473

CVE-2018-15473 - SSH Username Enumeration Exploit A tool for enumerating valid usernames on vulnerable SSH servers OpenSSH 2.3 through 7.7. 📋 Vulnerability Description CVE-2018-15473 allows enumeration of existing users on SSH servers by sending malformed authentication packets. The server respon...

CVE-2022-22972

CVE-2022-22972 vmware authentication bypass -host string Auth Servers,bugs365.com -url string Vul url,-url https://xxx.com -user string username default "administrator"...

cups-script-final-project

What it does Two-stage detection tool for CVE-2025-58060, authentication bypass vulnerability in the Common UNIX Printing System CUPS. Rather than relying on version numbers alone, the tool combines a banner-based version check with an active auth bypass probe. This helps confirming real...

FORTIWEB_CVE-2025-64446-58034

FortiWeb Exploit Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without authorization. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, two...

oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM Authentication Bypass Exploit Introduction Exploiting Oracle Access Manager OAM padding oracle vulnerability CVE-2018-2879 to perform authentication bypass and login to any web app protected by OAM using valid username. This exploit is based on OAM padding oracle...

CVE-2025-29927-Proof-of-Concept

Walkthrough Step 1 5 min Hint Which network services are exposed by the target? — — — Solution kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p Step 2 5 min Hint 1 The landing page only reveals a login page, but web servers often expose additional paths. Hint 2 Try using a directory brute-forcing too...

HikVision-CVE-2017-7921

HikVision-CVE-2017-7921 Identify potential vulnerabilities with CVE-2017-7921 exploit checks or by testing the /onvif-http/snapshot?auth=YWRtaW46MTEK URI on target IP addresses using a multi-threaded approach for faster results. Requirements python3 Python Pacakges = requests, Fakeuseragent,...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...

CVE-2026-24061

GNU InetUtils telnetd Authentication Bypass via Argument Injection - CVE-2026-24061 📚 Introduction A recently identified argument injection vulnerability in GNU InetUtils telnetd allows attackers to circumvent authentication by setting the USER environment variable to the value “-f root”. As a...

CVE-2021-32648

CVE-2021-32648 Proof Of Concept code for OctoberCMS Auth Bypass CVE-2021-32648...

CVE-2024-3094-patcher

Ansible Playbook for Patching xz-Utils Vulnerability CVE-2024-3094 This document details an Ansible playbook designed to address the critical vulnerability CVE-2024-3094 identified in xz-Utils versions 5.6.0 and 5.6.1. This vulnerability, classified as a backdoor, grants attackers unauthorized...

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...

CredSpy

CredSpy Enumerate Microsoft Entra ID authentication methods for email addresses using the public GetCredentialType API. This is the same endpoint the Microsoft login page uses when you enter a username. In contrast to most tools using the GetCredentialType method, CredSpy also shows the...

CVE-2026-21962

🚨 CVE-2026-21962 - Critical Authentication Bypass Vulnerability 🧾 Summary 🔥 A maximum severity 10.0 vulnerability enabling unauthenticated remote access to Oracle middleware systems. CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass CWE : CWE-284...

CVE-2025-25257-Exploit-Tool

CVE-2025-25257 Exploit Tool Credits Based on watchTowr Labs, 0xbigshaq, and pwner.gg analyses. Warnings For educational purposes only. Use on authorized systems. Modifies database/filesystem. Enhanced Python tool for detecting and exploiting CVE-2025-25257 Pre-Auth SQLi to RCE in Fortinet FortiWe...

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...

writeup-cve-2019-19194

Writeup CVE-2019-19194 This is a writeup and theoretical Proof-of-Concept of CVE-2019-19194. ⚠️ This CVE was found by https://asset-group.github.io/disclosures/sweyntooth/ Table of Content Summary Vulnerable software and version Overview Protocol Stack and Architecture Pairing Procedure Proof of...