Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

CVE-2026-8181

CVE-2026-8181 Prova di concetto Ricerca • Validazione • Test di sicurezza "le rose sono rosse, le viole sono blu, credo di essermi appena cagato addosso pensando a te. rizz" Panoramica CVE Campo| Valore ---|--- CVE ID| CVE-2026-8181 Tipo| Bypass dell'autenticazione Impatto| Escalation dei privile...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

CVE-2026-8181

CVE-2026-8181 यह भेद्यता बिना प्रमाणीकरण वाले हमलावरों को, जो किसी वैध व्यवस्थापक उपयोगकर्ता नाम जानते हैं, Basic Authentication हेडर में किसी भी गलत पासवर्ड का उपयोग करके REST API अनुरोधों के दौरान उस व्यवस्थापक का रूप धारण करने की अनुमति देती है। हमलावर इस दोष का दुरुपयोग कर पूर्व प्रमाणीकरण के...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

phishery

phishery Phishery ist ein einfacher SSL-fähiger HTTP-Server, dessen Hauptzweck das Phishing von Anmeldedaten über Basic Authentication ist. Phishery bietet auch die Möglichkeit, die URL einfach in ein .docx-Word-Dokument einzufügen. Die Stärke von phishery zeigt sich am besten, wenn die Vorlage...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

CVE-2026-41940

CVE-2026-41940: Bypass dell'autenticazione in cPanel/WHM singolo e multi-target Disclaimer: Questo documento e lo script associato exploit.py sono forniti esclusivamente a scopo educativo, per ricerche di sicurezza e test di penetrazione autorizzati. Non utilizzare questo software contro sistemi...

CVE-2026-41940

CVE-2026-41940: Bypass de Autenticação do cPanel/WHM Alvo Único e Múltiplos Alvos Aviso Legal: Este documento e o script associado exploit.py são fornecidos estritamente para fins educacionais, pesquisa de segurança e testes de penetração autorizados. Não use este software contra sistemas que voc...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM Cross-Tenant-Signup-Bypass Status 01.12.2025: Diese Schwachstelle ist weiterhin aktiv und ausnutzbar. Microsoft hat dieses Problem nicht behoben und betrachtet es als „by design“. Sicherheitshinweis GHSA-vcwf-73jp-r7mv CVE-2025-66390 Zusammenfassung Eine Sicherheitslücke im Azure API...

EUVD-2026-65328

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

CVE-2026-41940

CVE-2026-41940 - Bypass dell'autenticazione cPanel/WHM Questo repository contiene un report in inglese con dati oscurati e uno strumento di verifica basato su Go per CVE-2026-41940, un bypass dell'autenticazione cPanel/WHM causato dall'iniezione CRLF nella gestione dell'autenticazione Basic. Tutt...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentifizierungs-Bypass Einzel- & Multi-Ziel Haftungsausschluss: Dieses Dokument und das zugehörige Skript exploit.py werden ausschließlich für Bildungszwecke, Sicherheitsforschung und autorisierte Penetrationstests bereitgestellt. Verwenden Sie diese Software nicht...

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

EUVD-2026-51613

Contao crawler leaks auth credentials to external hosts...

GHSA-X677-9FXG-V5C5 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...