cve-2019-1040-scanner

CVE-2019-1040 scanner Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target hosts and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx. Note...

CVE-2020-15906

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Frederic MohrLastbreach for your Backend Support. Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated...

CVE-2026-113736

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

CVE-2026-113736

The D-Link DHP-W610AV (firmware version 1.02EUb03 ) is vulnerable to a critical flaw in the HNAP Login component. Specifically, the login_prepare_hnap function within the etc/defnodes/defaultvalue.xml file can be manipulated. By manipulating the Password argument, an attacker can cause the config...

EUVD-2026-106988

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

PT-2026-120163

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login prepare hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement

A flaw was found in MariaDB. An authenticated attacker with low privileges can achieve privilege escalation by modifying the password of another database account. This vulnerability occurs because the database server checks incorrect authorization privileges when processing a GRANT PROXY statemen...

mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement

A flaw was found in MariaDB. An authenticated attacker with low privileges can achieve privilege escalation by modifying the password of another database account. This vulnerability occurs because the database server checks incorrect authorization privileges when processing a GRANT PROXY statemen...

CVE-2026-97380

A flaw was found in MariaDB. An authenticated attacker with low privileges can achieve privilege escalation by modifying the password of another database account. This vulnerability occurs because the database server checks incorrect authorization privileges when processing a GRANT PROXY statemen...

Red Hat: CVE-2026-97380: mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. In versions prior to 2.7.0, NT LAN Manager NTLM authentication does not properly abort when someone provides an empty password value. This issue affects FreeRDP-based RDP Server implementations. RDP clients are not affected. The...

CVE-2026-74035

Wazuh versions 4.6.0 before 4.14.8 are vulnerable to an authentication bypass in the security.update_user component. The root cause is the placement of the reserved user guard and password policy inside a falsy truthiness check . This flaw allows a delegated user administrator to submit an empty ...

CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2020-1472

CVE-2020-1472 arp-scan Rangip nmap -A -vv -Pn IPADDR python3 setemptypw.py DCNETBIOSNAME DCIPADDR python3 secretsdump.py -no-pass -just-dc DOMAIN/DCNETBIOSNAME$@DCIPADDR python3 wmiexec.py -hashes HassPasswdUser DOMAIN/User@dcipaddr windows command whoami systeminfo hostname md testdir echo test...

CVE-2026-84398

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

EUVD-2026-83033

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

CVE-2026-84398

CareCam CM2507 IP cameras are vulnerable to unauthorized access due to an empty password accepted for a privileged account exposed through the ONVIF management service. The root cause is an empty password stored in a configuration file, allowing an attacker with network access to reach privileged...