CVE-2026-16232

CVE-2026-16232 — Bypass de autenticación de SmartConsole de Check Point PoC de bypass de autenticación desde acceso de red no autenticado hasta privilegios completos de administrador. Archivo único, Python 3, solo biblioteca estándar, cero dependencias. Resumen de la vulnerabilidad El servicio de...

Ivanti-Connect-Around-Scan

Comprobador de Vulnerabilidad Ivanti Connect Around Comprobador de Vulnerabilidad Ivanti Connect Around Resumen Características Tipos de Comprobaciones WEB ACCESS SYSTEM INFO BYPASS DETECTED Explicación de los Tipos de Estado Primeros Pasos Requisitos Uso Argumentos Especificación del Objetivo...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP Unauthenticated RCE Vulnerability F5 BIG-IP iControl REST身份验证绕过RCE漏洞 fofa keywords: title="BIG-IP- Redirect" usage attack root@kitploit: $ python3 cve-2022-1388.py -t https://203.xxx.xxx.xxx + https://203.xxx.xxx.xxx is vulnerable input your command:...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 Vulnerabilidad de omisión de autenticación en F5 BIG-IP iControl REST ⚠️ Descargo de responsabilidad Esta herramienta es solo para el intercambio de investigaciones de seguridad cibernética. ¡Los usuarios deben cumplir con la ley de seguridad cibernética y usarla de...

CVE-2024-10924

Exploit CVE-2024-10924 - Bypass de 2FA del plugin Really Simple SSL de WordPress Resumen Este repositorio contiene un exploit para CVE-2024-10924 , una vulnerabilidad en el plugin Really Simple SSL para WordPress. Permite a un atacante omitir el proceso de configuración de la autenticación de dos...

CVE-2020-14882

WebLogic CVE-2020-14882 / CVE-2020-14883 Test Script This project provides a simple Bash script for testing whether an Oracle WebLogic server is vulnerable to the authentication bypass CVE-2020-14882 and the associated remote code execution vector CVE-2020-14883. The script sends a POST request t...

CVE-2026-84483

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php . An unauthenticated attacker can forge valid HMAC tokens by computing hash_hmac with the site's public base URL as the key and the current time as the message. With forged tokens, an attacker...

CVE-2026-84479

WWBN AVideo (version e01e41ecc and earlier) contains an authentication bypass vulnerability where three login-time security controls rely solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks match HTTP_USER_AGENT against hardcoded literals ("AVideo...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php , allowing an attacker who obtains a recovery token to use it indefinitely to reset a target account's password and gain full account access . The vulnerability is network-exploitable with low complex...

CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

CVE-2026-84476

WWBN AVideo contains an authentication bypass flaw in its login rate limiting mechanism. The application fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, which are consumed by the enforceRateLimit() function. An unauthenticated, network-based attacker can ...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2022-27925

CVE-2022-27925 Descripción El 10 de mayo de 2022, Zimbra publicó las versiones 9.0.0 parche 24 y 8.8.15 parche 31 para abordar múltiples vulnerabilidades en Zimbra Collaboration Suite, incluyendo CVE-2022-27924 sobre la que escribimos anteriormente y CVE-2022-27925. Originalmente, Zimbra denominó...

CVE-2026-18730

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...