D-Link-CVE-2021-27342-exploit

D-Link-CVE-2021-27342-exploit Exploit para la vulnerabilidad CVE-2021-27342 bypass de protección de autenticación telnet por fuerza bruta...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: Sin límite de velocidad en /login permite fuerza bruta ilimitada de contraseñas Producto: dgtlmoon/changedetection.io — v0.55.7 Archivo: changedetectionio/flaskapp.py CWE: CWE-307 — Restricción inadecuada de intentos de autenticación excesivos CVSS 3.1:...

wargame-turkey_in_2

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

PT-2026-106766

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description The software uses a lower-than-recommended PBKDF2 work factor for password hashing. PBKDF2 Password-Based Key Derivation Function 2 is a...

PT-2026-106717

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

PT-2026-106732

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...

PT-2026-106742

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro rpc port. Attackers can send forged requests with the force flag set to bypa...

cve-2017-7921-golang

Exploit de omisión de Hikvision Requisitos 1. github.com/levigross/grequests 2. github.com/msterzhang/gpool 3. golang.org/x/net 4. github.com/go-vgo/robotgo Compilación git clone https://github.com/MisakaMikato/cve-2017-7921-golang.git cd cve-2017-7921-golang/src/cve-2017-7921-golang go build . U...

CVE-2020-27747

CVE-2020-27747 Posible toma de control de cuenta | Capacidad de fuerza bruta Descripción sugerida Se descubrió un problema en Click Studios Passwordstate 8.9 Build 8973. Si el usuario del sistema se ha asignado un código PIN para acceder desde un dispositivo móvil mediante el generador integrado ...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32位漏洞利用实验室 该仓库是一个可重现的Docker实验室，用于研究nginx 1.30.0中的CVE-2026-42945。它包含一个易受攻击的32位目标、一个原始触发器、一个实验室辅助的已知地址RCE验证器，以及一个无自省的暴力破解驱动。 漏洞利用的边界很重要： exploit/triggeroob.py 演示了堆越界写入原语。 exploit/labknownaddress.py 在Docker中验证了RCE机制，但它属于实验室辅助方式，因为它通过 docker exec 读取 /proc//maps。...

CVE-2026-90330

A flaw was found in the Linux kernel's logitech-hidpp driver. During the initialization of a force-feedback device, if certain memory allocations fail, the driver does not properly clean up previously allocated resources. This improper resource management could lead to a resource leak, potentiall...

CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...

CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...

CVE-2026-105638

The project management tool Plane is vulnerable to a 6-digit OTP brute force attack in versions prior to 1.4.0 . The magic-code email login verifier lacks a per-code failed-attempt counter, fails to invalidate Redis entries on incorrect attempts, and does not lock email addresses. Because the ver...

CVE-2023-5561-POC-Updated

CVE-2023-5561-POC-Updated Este repositorio contiene una versión modificada del Prueba de Concepto PoC original para CVE-2023-5561. El PoC original, que se puede encontrar aquí, envía un alto volumen de solicitudes en paralelo, lo que puede activar los Firewalls de Aplicaciones Web WAF o provocar...

solrradar

Marco de Reconocimiento Masivo y Explotación para Apache Solr Inyección de Plantillas Velocity → Ejecución Remota de Código 📑 Tabla de Contenidos Resumen de la Vulnerabilidad Versiones Afectadas Características Instalación Uso Prueba de Concepto Análisis Técnico en Profundidad Metodología de...

CVE-2024-53591

CVE-2024-53591 描述: Seclore v3.27.5.0 登录页面中的一个问题允许攻击者通过暴力攻击枚举有效域（内部服务）。 POC: https://company/policyserver/redirectTprepositoryEntryAction.do?repoCode=10006, 暴力破解 repoCode 参数以查找所有托管域和内部服务 发现者：Aljohara Abdulmohsen Alsubaie...

CVE-2024-28000

PoC de Escalada de Privilegios en LiteSpeed Cache - CVE-2024-28000 🎤 Traducción del README Inglés فارسی 📸 Captura de pantalla 💎 Introducción Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad crítica de escalada de privilegios descubierta en el plugin LiteSpeed Cache de...

CVE-2017-7921

CVE-2017-7921 海康威视未授权访问检测poc及口令检测 使用方法Usage： Usage: -a 加载Poc模块 -b 加载密码爆破模块 -e 加载Exp模块 -f string 文件名称 默认为空 -i string 输入ip地址 eg:192.0.0.1-192.0.0.255 -p string 密码 default:12345 default "12345" -s string 协议 eg:http default "http" -t int 线程数量 默认50 default 50 -u string 用户名 default:admin default "admin...

CVE-2020-15367

CVE-2020-15367 Supravizio BPM 10.1.2 暴力破解 描述 Venki Supravizio BPM 10.1.2 未限制认证尝试次数。未认证用户可利用此漏洞对登录页面发起暴力破解攻击。 利用 要利用此漏洞，需要先利用密码找回功能中的用户枚举漏洞（CVE-2020-15392）枚举出有效用户，然后可使用不同密码进行任意次数的认证尝试，最终获得目标账户的访问权限。 概念验证（PoC） 登录页面 暴力破解登录 - 无效用户 暴力破解登录 - 有效用户...