CVE-2024-45409

Эксплойт обхода аутентификации Ruby-SAML / GitLab CVE-2024-45409 Этот скрипт эксплуатирует CVE-2024-45409, который позволяет неаутентифицированному атакующему, имеющему доступ к любому подписанному SAML-документу, выданному IDP, подделать SAML Response/Assertion и получить доступ к GitLab в...

CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass

ConnectWise ScreenConnect: Обход аутентификации Введение Этот проект направлен на эксплуатацию уязвимости обхода аутентификации в ConnectWise ScreenConnect. Он предоставляет скрипт для демонстрации эксплойта. Пожалуйста, убедитесь, что у вас есть необходимые разрешения, прежде чем пытаться...

CVE-2022-46169_unauth_remote_code_execution

CVE-2022-46169 - Cacti에서의 인증되지 않은 원격 코드 실행 Cacti 1.2.23 및 1.3.0에서 인증 우회 및 명령 삽입을 통한 인증되지 않은 원격 코드 실행 면책 조항: 이 스크립트는 시스템의 보안을 감사하기 위해 제작되었습니다. 이 스크립트는 본인 소유의 시스템 또는 악용에 대한 서면 허가를 받은 시스템에서만 사용하십시오...

PT-2026-84578

Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 14.184.308 Description An issue exists where the software fails to enforce authentication requirements during the local account password reset flow. This allows unauthenticated attackers to reset local...

CVE-2024-35585

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

CVE-2024-35585

Oxford Nanopore MinKNOW , a sequencing software used in nanopore-based genomic analysis, is vulnerable to weak authentication in versions before 24.06 . The application relies on a client's source IP address as its authentication mechanism, meaning an attacker who can spoof or originate traffic f...

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token...

EUVD-2024-55746

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

ScreenConnect-AuthBypass-RCE

Как использовать Я использую Python3.9 root@kitploit: pip install requests python check.py python batchAdduser.py root@kitploit: python ScreenConnect-AuthBypass-RCE.py -h usage: ScreenConnect-AuthBypass-RCE.py -h -u USERNAME -p PASSWORD -t TARGET -d DOMAIN --proxy PROXY CVE-2024-1708 &&...

CVE-2022-20607

CVE-2022-20607 В прошивке сотового модема Pixel возможна запись за пределами буфера из-за отсутствия проверки границ. Это может привести к удаленному выполнению кода, для которого требуется аутентификация LTE. Для эксплуатации не требуется взаимодействие с пользователем.Product: AndroidVersions:...

Published-CVE

Published-CVE Этот репозиторий содержит описания и эксплойты для двух уязвимостей безопасности: 1. CVE-2023-33580: Хранимая межсайтовая XSS-уязвимость Cross-Site Scripting в Student Study Center Management System V1.0, позволяющая злоумышленникам выполнять произвольный JavaScript-код. 2...

DNN_CVE-2015-2794

DNNCVE-2015-2794 NSE-плагин для Nmap, который сканирует веб-приложение DotNetNuke DNN на наличие уязвимости обхода аутентификации администратора CVE-2015-2794, EDB-ID: 39777...

CVE-2022-41082

CVE-2022-41082 This repository contains a proof-of-concept PoC tool for exploiting the OWASSRF vulnerability CVE-2022-41082 in Microsoft Exchange servers. The exploit allows attackers to execute arbitrary commands on the server, potentially compromising the system. Overview The tool leverages an...

CVE-2023-29919

Краткое описание: В SolarView Compact версии 6.00 и ниже существует уязвимость произвольного чтения файлов, злоумышленники могут обойти аутентификацию и читать файлы через texteditor.php Производитель: SolarView Compact Затронутый продукт: SolarView Compact =ver 6.00 PoC:...

CVE-2026-84479

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2025-48827

CVE-2025-48827 - vBulletin 인증 우회 익스플로잇 개요 이 저장소는 PHP 8.1 이상에서 실행되는 vBulletin 5.0.0–5.7.5 및 6.0.0–6.0.3에 영향을 미치는 중요한 인증 우회 취약점인 CVE-2025-48827에 대한 개념 증명 익스플로잇을 포함합니다. 이 취약점을 통해 인증되지 않은 공격자가 보호된 API 메서드를 원격으로 호출할 수 있으며, 잠재적으로 원격 코드 실행과 전체 시스템 손상으로 이어질 수 있습니다. 작성자: pszyszkowski 심각도: 치명적 CVE:...

CVE-2026-84423

Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...

CVE-2025-2825

CVE-2025-2825/CVE-2025-31161 Introduction This document presents a security analysis of vulnerability CVE-2025-2825 affecting the server component of CrushFTP — a commercial solution for file transfer and storage FTP, SFTP, HTTP/S, S3-like interfaces, etc.. The defect is classified as an...

CVE-2025-63700

CVE-2025-63700 OAuth Authentication Bypass in Clerk-js 5.88.0 Affected Product Vendor : Clerk Inc. clerk.dev / clerk.com Product : Clerk-js @clerk/clerk-js Affected Version : 5.88.0 Impact : OAuth Authentication Bypass CWE-290 : Authentication Bypass by Spoofing Bug Author Hasnat Ibrahim Nishat -...