CVE-2019-19550

CVE-2019-19550 Description Contournement d'authentification à distance dans Senior Rubiweb 6.2.34.28 et 6.2.34.37 permet un accès administrateur aux informations sensibles des utilisateurs concernés utilisant les versions vulnérables. L'attaquant a seulement besoin de fournir l'URL correcte...

MultiExploit

다중 서비스 취약점 스캐너 지원되는 취약점 및 공격 벡터 Microsoft SQL Server 취약점 CVE-2023-21173 : SQL Server 2022에서의 원격 코드 실행 잠재적인 악용 대상: 약한 인증 구성 잘못 구성된 서버 보안 주체 xpcmdshell 남용 고급 옵션 조작 일반적인 취약점 클래스 1. 인증 우회 약한/기본 자격 증명 빈 비밀번호 시도 잘못 구성된 인증 메커니즘 2. 서비스 열거 FTP 익명 접근 열린 데이터베이스 포트 노출된 서비스 정보 3. 잠재적 공격 표면 MSSQL 원격 명령 실행 FTP ...

rdpy

RDPY Protocole de bureau à distance en Python Twisted. RDPY est une implémentation pure Python du protocole Microsoft RDP Remote Desktop Protocol côté client et serveur. RDPY est construit sur le moteur réseau piloté par événements Twisted. RDPY prend en charge la couche de sécurité RDP standard,...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

CVE-2023-27350

CVE-2023-27350 POC pour CVE-2023-27350 affectant PaperCut MF/NG Analyse technique Une analyse technique de la cause racine de la vulnérabilité, des indicateurs de compromission et de l'exposition sur Internet est disponible sur notre blog :...

SAP_EEM_CVE-2020-6207

CVE-2020-6207 에 대한 PoC SAP Solution Manager의 인증 확인 누락 이 스크립트는 SAP Solution Manager에 연결된 SAP SMDAgent에서 RCE로 이어지는 SAP EEM 서블릿tcsmdagentapplicationeem의 인증 확인 누락을 확인하고 악용할 수 있게 해줍니다. 원본 발견: Pablo Artuso Yvan 'iggy' G 논문: An Unauthenticated Journey to Root :Pwning Your Company's Enterprise Software...

CVE-2026-84485

APITable versions through 1.13.0-beta.1 expose an internal organization loadOrSearch endpoint without requiring authentication. This allows unauthenticated attackers to retrieve member names, email addresses, and team hierarchy by querying the endpoint with space identifiers obtained from shared ...

CVE-2026-84485 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84696

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

CVE-2024-48322

CVE-2024-48322 Вам нужна учётная запись в экземпляре RunCodes, любого уровня привилегий. Установите с помощью poetry и запустите, указав базовый URL экземпляра. root@kitploit: $ python pay.py Проверьте свой почтовый ящик — пароль должен быть там...

NamedPipePTH

NamedPipePTH Ce projet est un code de Preuve de Concept PoC pour utiliser Pass-the-Hash pour l'authentification sur une impersonation d'utilisateur de Named Pipe locale. Il existe également un article de blog explicatif : https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ Il est fortement basé sur ...

CVE-2025-29927

CVE-2025-29927: Next.js 미들웨어 우회 취약점 이 저장소는 Next.js에서 내부 헤더 x-middleware-subrequest를 사용하여 인증과 같은 미들웨어 검사를 우회할 수 있는 CVE-2025-29927 취약점을 시연합니다. 취약점 세부 정보 Next.js는 재귀 요청이 무한 루프를 유발하지 않도록 내부 헤더 x-middleware-subrequest를 사용합니다. 보안 취약점은 미들웨어 실행을 건너뛸 수 있음을 보여주며, 이로 인해 요청이 라우트에 도달하기 전에 인증 쿠키 검증과 같은 중요한 검사를...

cve-2025-57819

🛡️ FreePBX Hunter - CVE-2025-57819 🛡️ Мощный набор инструментов Nuclei для обнаружения и проверки критической уязвимости обхода аутентификации FreePBX. 📖 Оглавление Нажмите, чтобы развернуть О проекте Ключевые возможности Разбор уязвимости Шаблоны в действии Поиск целей с помощью Shodan Правовое...

CVE-2020-1472-LAB

Скрипт тестирования ZeroLogon Лабораторная настройка для тестирования уязвимости эксплойта ZeroLogon CVE-2020-1472. Включает Python-скрипт, использующий библиотеку Impacket для проверки уязвимости, и виртуальную машину VM с Windows Server 2019, настроенную как контроллер домена DC. Скрипт пытаетс...

EUVD-2026-69790

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...

CVE-2026-84696 Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

EUVD-2026-69787

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...