Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

JetBrains TeamCity > 2023.11.3 - Authentication Bypass

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible id: CVE-2024-23917 info: name: JetBrains TeamCity 2023.11.3 - Authentication Bypass author: iamnoooob,rootxharsh,pdresearch severity: critical description: | In JetBrains TeamCity before 2023.11.3...

WordPress Plugin MainWP Child - Authentication Bypass

The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the "Require unique security ID" option is no...

Apache CloudStack - SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

Ray Static File - Local File Inclusion

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. id: CVE-2023-6020 info: name: Ray Static File - Local File Inclusion author: byt3bl33d3r severity: high description: | LFI in Ray's /static/ directory allows attackers to read any file on the...

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Strapi Versions <=4.5.6 - Authentication Bypass

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

phpBB < 3.3.17 - Authentication Bypass

phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

CVE-2023-36899

CVE-2023-36899 Reproduction environment and tooling for CVE-2023-36899, a cookieless session authentication bypass in the ASP.NET framework. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 In modern web development, despite cookies being the preferred...

CVE-2024-6670

CVE-2024-6670 إثبات مفهوم PoC لثغرة تجاوز المصادقة عبر حقن SQL في Progress Software WhatsUp Gold HasErrors CVE-2024-6670 يمكن العثور على تحليل السبب الجذري للثغرة في مدونتي: https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ الاستخدام root@kitploit: python CVE-2024-6670.py...

fitness-app

Fitbit Open Source Android App This app is based on the work of Jiska Classen, Matthias Hanreich, Steffen Kreis, Tobias Krichel, Johannes Riedel and Sven Ströher. Features Scan for BLE Fitbit devices Authenticate against Fitbit server like the original app Obtain authentication credentials from t...

SAP_EEM_CVE-2020-6207

PoC for CVE-2020-6207 Missing Authentication Check in SAP Solution Manager This script allows to check and exploit missing authentication checks in SAP EEM servlet tcsmdagentapplicationeem that lead to RCE on SAP SMDAgents connected to SAP Solution Manager Original finding: Pablo Artuso Yvan 'igg...

latma

Outil d'analyse de mouvement latéral L'outil d'analyse de mouvement latéral LATMA collecte les journaux d'authentification du domaine et des environnements Azure AD et recherche les potentielles attaques de mouvement latéral et activités suspectes. Le mouvement latéral peut se situer dans...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

keycloak

Gestion des identités et des accès open source...

Apache-OFBiz-Authentication-Bypass

Apache OFBiz Authentication Bypass Vulnerability CVE-2023-51467 and CVE-2023-49070 This exploit script and PoC are written for an in-depth CVE analysis on vsociety. The Apache OFBiz Enterprise Resource Planning ERP system, a versatile Java-based web framework widely utilized across industries, is...

CVE-2024-9464

CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Proof of concept to exploit CVE-2024-9464 on vulnerable devices. This script chains the admin reset of CVE-2024-5910 to achieve "unauthenticated" arbitrary command execution. Blog Post Root cause and indicators of compromise here...