CVE-2026-107231

The AsyncHttpClient (AHC) library for Java applications is vulnerable to an authentication downgrade attack in versions prior to 3.0.13 and 2.16.1 . The Realm.Builder component incorrectly treats a Digest challenge that lacks a usable nonce as a Basic challenge . An attacker controlling a proxy o...

CVE-2026-41940

CVE-2026-41940: Contournement d'authentification cPanel/WHM Cible unique & Multi-cibles Avertissement : Ce document et le script associé exploit.py sont fournis strictement à des fins éducatives, de recherche en sécurité et de tests d'intrusion autorisés. N'utilisez pas ce logiciel contre des...

CVE-2026-41940

CVE-2026-41940: Обход аутентификации cPanel/WHM одиночная и множественная цель Дисклеймер: Этот документ и связанный с ним скрипт exploit.py предоставлены строго в образовательных целях, для исследований в области безопасности и авторизованного тестирования на проникновение. Не используйте это...

phishery

phishery Phishery est un serveur HTTP simple avec SSL dont le but principal est le hameçonnage d'identifiants via l'authentification de base. Phishery offre également la possibilité d'injecter facilement l'URL dans un document Word .docx. La puissance de phishery est mieux démontrée en définissan...

Azure-APIM-Cross-Tenant-Signup-Bypass

Обход регистрации в Azure APIM между арендаторами Статус 01.12.2025: Эта уязвимость по-прежнему активна и эксплуатируема. Microsoft не исправила эту проблему и считает её «предусмотренной конструкцией». Уведомление о безопасности GHSA-vcwf-73jp-r7mv CVE-2025-66390 Краткое описание Уязвимость...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Swego

Swego Couteau suisse de serveur web en Golang. Restez simple comme le SimpleHTTPServer de Python mais avec de nombreuses fonctionnalités. Utilisation Exécuter le binaire Si vous ne voulez pas le compiler, des binaires sont disponibles sur https://github.com/nodauf/Swego/releases Sinon,...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

CVE-2026-8181

CVE-2026-8181 Cette vulnérabilité permet à des attaquants non authentifiés qui connaissent un nom d'utilisateur administrateur valide d'usurper l'identité de cet administrateur lors des requêtes d'API REST en utilisant un mot de passe incorrect quelconque dans un en-tête d'authentification Basic...

Cisco ASA Credentials Management Errors (CVE-2019-1714)

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM 인증 우회 단일 및 다중 타깃 면책 조항: 본 문서와 관련 스크립트exploit.py는 교육 목적, 보안 연구, 그리고 승인된 침투 테스트를 위해서만 제공됩니다. 소유하지 않았거나 테스트에 대한 명시적 허가를 받지 않은 시스템에는 이 소프트웨어를 사용하지 마십시오. 개요 exploit.py는 cPanel & WHM에서 인증 우회 취약점CVE-2026-41940을 시연하는 스크립트입니다. 이 취약점으로 인해 인증되지 않은 공격자는 CRLF 주입 결함을 통해 데몬 캐시에 루트 세션을...

CVE-2026-8181

CVE-2026-8181 Доказательство концепции Исследование • Валидация • Тестирование безопасности "розы красны, фиалки сини, кажется, я обосрался от мысли о тебе. ризз" Обзор CVE Поле| Значение ---|--- CVE ID| CVE-2026-8181 Тип| Обход аутентификации Влияние| Эскалация привилегий / Полный захват сайта...

CVE-2026-41940

CVE-2026-41940 - Обход аутентификации cPanel/WHM Этот репозиторий содержит английское отредактированное описание и инструмент проверки на Go для CVE-2026-41940 — обхода аутентификации cPanel/WHM, вызванного CRLF-инъекцией в обработке базовой аутентификации. Все списки живых целей, экспорты активо...

EUVD-2026-90890

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322: Insertion of Sensitive Information Into Sent Data

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-74865

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865

The sogo_yhn component contains an authentication bypass vulnerability caused by the configuration parameter SOGoTrustProxyAuthentication=YES. This configuration allows an unauthenticated attacker to bypass password requirements during HTTP Basic authentication by providing a valid username and a...