cupntlm-Automated-Exploit-For-CVE-2025-33073-

cupntlm CVE-2025-33073 — Bypass de reflexión NTLM mediante coerción DNS Herramienta de explotación automatizada para entornos de Active Directory. Descripción general cupntlm automatiza la cadena de ataque de reflexión/retransmisión NTLM que abusa de CVE-2025-33073. Combina la inyección de...

CVE-2025-33073

Obscura$ DNS 中继注入 + NTLM 强制认证工具 一个隐蔽的概念验证（PoC）工具，它将 DNS 注入、NTLM 中继与基于 RPC 的强制认证串联起来，用于测试 Windows Active Directory 环境中的认证中继路径。 ⚠️ 免责声明：仅限授权安全测试与教育用途使用。 ❌ 严禁未经授权使用。作者对滥用行为不承担任何责任。 🔧 功能特性 通过 samba-tool 注入 DNS A 记录 验证 DNS 记录传播情况 使用 impacket-ntlmrelayx 启动 NTLM 中继监听器 通过 rpcping（MS-RPRN 强制认证）触发强制身份验证...

CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

EUVD-2026-72384

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass in its REST API caused by MySQL type coercion : unauthenticated attackers can send small integers (0–9) instead of string tokens, allowing them to match token hashes and access protected endpoints. Successful exploitation exposes device cre...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

PT-2026-86792

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

windows-coerced-authentication-methods

本仓库收录了多种强制 Windows 机器向攻击者控制的机器进行身份验证的方法。 所有这些方法都可以由域中的标准用户调用，以强制目标 Windows 机器（通常是域控制器）的机器账户向任意目标进行身份验证。这些方法中每个“漏洞/特性”的根本原因在于：Windows 机器在尝试访问 UNC 路径（如 \192.168.2.1\SYSVOL\file.txt）时，会自动向其他机器进行身份验证。 目前共有 15 个可用函数，涵盖 5 种协议。 !NOTE 🎉 还有许多新方法有待测试，如果你想尝试它们：possible-working-calls...

CVE-2026-33829-Writeup

CVE-2026-33829 分析报告 漏洞案例研究：CVE-2026-33829（Windows 截图工具 NTLM 强制认证） 执行摘要 本文详细记录了CVE-2026-33829 的技术复现过程，这是现代 Windows 截图工具应用程序框架中的一个信息泄露漏洞。通过滥用自定义 URI 协议处理器中一个未经验证的输入参数，远程主机可以强制未打补丁的 Windows 机器发起出站 SMB 连接，从而导致 Net-NTLMv2 身份验证哈希值通过网络泄露。 URI 方案 —— （Windows 使用自定义协议（如 ms-screensketch:、ms-settings:、file:）...

EUVD-2026-61221

fastify vulnerable to schema validation bypass via root primitive coercion mismatch...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

SmallRye GraphQL contains a flaw in its number scalar coercion for BigInteger , which fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query containing a large exponent float literal, triggering the allocation of extremely l...

EUVD-2026-68525

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-18504

A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application...

EUVD-2026-66760

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

CVE-2026-65641

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

CVE-2026-65641

CVE-2026-65641 is a Critical (CVSS 9.3) vulnerability in Veeam ONE affecting all version 13 builds from 13.1.0.7034 and earlier (12.x is not affected). An unauthenticated network attacker can coerce the Veeam ONE service account into performing SMB (NTLM) authentication , potentially exposing the...

CVE-2026-65641

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...