Bcrypt-forcer

Bcrypt-forcer sqlmap Bcrypt decryption tool Bcrypt hash cracker...

hmac-bcrypt

hmac-bcrypt This repository contains reference implementations of the hmac-bcrypt password hashing function in several languages. Each reference implementation attempts to be a 1:1 port of the original C and Perl implementations created by @epixoip where possible, and are fully compatible with ea...

CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90533

Flowise before 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. Any authenticated organization member can query the endpoint with an arbitrary user ID to retrieve the organization owner's full user record, including the bcrypt password hash ...

CVE-2026-8794

CVE-2026-8794 — Username Enumeration via Authentication Timing Side-Channel in PaperCut NG Field| Details ---|--- CVE ID| CVE-2026-8794 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-208 — Observable Timing Discrepancy CVSS Score| 3.7 Low — standalone; escalates...

xbootEncodePwd

xbootEncodePwd root@kitploit: xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT...

HTB-Pterodactyl-Writeup

HackTheBox — Pterodactyl Writeup Difficulty: Medium | OS: Linux openSUSE Leap 15.6 | Season: 10 Summary Pterodactyl is a medium-difficulty Linux machine running the Pterodactyl game server panel. The attack chain involves an unauthenticated LFI-to-RCE vulnerability in the panel, credential...

CVE-2026-25050

CVE-2026-25050 – Authentication Timing Attack This repository contains a Proof of Concept demonstrating a timing attack affecting the NativeAuthenticationStrategy.authenticate method. This PoC is provided as a technical demonstration for blog / research purposes. Vulnerability The authentication...

cve-2022-22976-bcrypt-skips-salt

BCrypt Hash Check To assist with the mitigation steps for CVE-2022-xxxx, you can use this tool to check your database for hashes that need updating. After you've integrated the application with your database, the tool works in two steps. To demonstrate this a in-memory sample application is used...

hello-ReGrade-security

hello-ReGrade-security A hands-on demo of zero-day discovery withReGrade. You'll point an ordinary test suite at ReGrade, record it against a tiny service, replay it against a second copy of the same service , and use Claude Code + the ReGrade MCP tools to surface a password-hash leak — a...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

CVE-2026-75112

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...