CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit 무차별 대입 완화 우회 CVE-2019-17240 일명 Bludit = 3.9.2 Brute-force 완화 우회를 위한 Exploit 코드 Exploit 링크: ExploitDB-48942 PacketStorm 예상 결과: Bludit = 3.9.2를 실행하는 호스트의 무차별 대입brute-force 메커니즘을 우회하여 로그인 자격 증명을 찾습니다. 교육 및 기업 환경에서의 테스트 용도로만 사용하세요. 이 Exploit은 Python 3.8.6에서 테스트되었습니...

CVE-2019-17240

CVE-2019-17240 Эксплойт Версии до 3.9.2 включительно CMS Bludit уязвимы для обхода механизма защиты от брутфорса, который блокирует пользователей, совершивших 10 или более неудачных попыток входа. Уязвимость была обнаружена Rastating. Отправка запроса на вход с изменяющимся значением заголовка...

CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden 이메일 2FA 무차별 대입brute-force 보호 우회 CVE-2026-43914 에 대한 개념 증명PoC: 이메일 2FA 가 활성화된 경우, Vaultwarden의 로그인 무차별 대입 보호는 인증되지 않은 POST /api/two-factor/send-email-login 엔드포인트를 통해 완전히 우회될 수 있으며, 이 엔드포인트는 무제한 마스터 비밀번호 오라클 역할을 합니다. 영향을 받는 버전: Vaultwarden 1.35.4 중요성 Vaultwarden은 가장 널리...

D-Link-CVE-2021-27342-exploit

D-Link-CVE-2021-27342-exploit Эксплойт для уязвимости CVE-2021-27342 обход защиты от брутфорса telnet-аутентификации...

CVE-2023-27100

CVE-2023-27100 - Обход защиты pfSense от перебора паролей Описание проблемы Система аутентификации пытается быть информативной и выводит дополнительную информацию вместе с IP-адресами, чтобы полностью идентифицировать, откуда пользователь выполняет вход при использовании графического интерфейса...

CVE-2025-66204

CVE-2025-66204: WBCE CMS позволяет обходить защиту от подбора пароля с помощью заголовка X-Forwarded-For Обзор Поле| Описание ---|--- Идентификатор CVE| CVE-2025-66204 Серьёзность| СРЕДНЯЯ Уведомление| Посмотреть уведомление Обнаружено| Lukasz Rybak Затронутые продукты WBCE/WBCECMS Подробности...

CVE-2019-17240-Bludit-3.9.2-Auth-Bruteforce-Bypass

CVE-2019-17240 Bludit 3.9.2 обход аутентификации методом перебора bruteforce...

CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

CVE-2026-94379

CVE-2026-94379 affects MISP (versions

PT-2026-96094

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The login function in UsersController.php contains insufficient HTTP method validation. The system uses an allowlist that only checks for POST and PUT methods before applying security controls. An...

EUVD-2026-81283

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

PT-2026-81990

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.5 and Red Hat build of Keycloak 26.6.5 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...