credactor

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

Confluence-Question-CVE-2022-26138-

Confluence-Question-CVE-2022-26138 Atlassian Confluence Server y Data Center: CVE-2022-26138 Cuando la aplicación 'Questions for Confluence' está instalada y habilitada en Confluence Server o Data Center, crea una cuenta de usuario de Confluence con el nombre de usuario 'disabledsystemuser' y la...

aigate

aigate Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files. Quick start root@kitploit: pip install aigate && aigate setup-all That's it. This installs a background proxy redact mode, a PostToolUse hook for file scanning,...

CVE-2015-7755-POC

CVE-2015-7755-POC CVE-2015-7755 漏洞检测 使用ssh连接存在漏洞的版本： ScreenOS 6.2.0r15—6.2.0r18，6.3.0r12—6.3.0r20 瞻博网络 user: root passwd: %sun='%s' = %u...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

CVE-2024-0368

CVE-2024-0368 Hustle Plugin = 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php Vulnerability Summary...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials

An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. id: CVE-2025-32815 info: name: NetMRI 7.6.1 - Authentication Bypass via Hardcoded Credentials author: iamnoooob,pdresearch severity: medium description: | An issue was discovered i...

LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

Silent-Call

Silent;Call Root remoto sin autenticación previa en Cisco Unified Communications Manager 15.x Tres solicitudes HTTP. Cero credenciales. Acceso root. Cada llamada ahora es tuya. Kill Chain Paso| Componente| Descripción ---|---|--- 1| Spoofhack| La suplantación de la cabecera X-Forwarded-For elude ...

MikroRoot

MikroRoot Versión automatizada de CVE-2018-14847. Buscará en Shodan hosts vulnerables e intentará explotarlos. Cómo usar Ten en cuenta que este script NO funcionará con Python2.x. Usa solo Python 3+ MikroRoot: python3 MikroRoot.py -k SHODANKEY -p page count User: ncss Pass: ncss!@2018 IP: 1.2.3.4...

juniper-cve-2015-7755

Juniper CVE-2015-7755 y CVE-2015-7756 Este repositorio contiene notas, binarios e información relacionada del análisis de los problemas CVE-2015-7755 y CVE-2015-7756 en Juniper ScreenOS. Para más información sobre estos problemas, consulte las siguientes URL:...

CVE-2022-26138

CVE-2022-26138 POC Description root@kitploit: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with...

CVE-2025-45466

CVE-2025-45466 Son los detalles de CVE-2025-45466 Divulgación de CVE: CVE-2025-45466 Resumen Se ha descubierto una vulnerabilidad en el perro robótico Unitree Go1 todas las versiones = Go120220511 que involucra credenciales de autenticación en texto plano codificadas , lo que conduce a un Control...

CVE-2018-14324-Exploit

Hackeando Eclipse GlassFish - CVE-2018-14324 La descripción de CVE-2018-14324 no explica completamente el impacto de esta vulnerabilidad. En resumen, tienes acceso a Java Management Extensions JMX mediante credenciales hardcodeadas admin:admin. Si bien el impacto se enumera como " información...

mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password

mySCADA myPRO 7 硬编码凭据 CVE-2018-11311 https://vulners.com/cve/CVE-2018-11311 https://www.exploit-db.com/exploits/44656/ http://myscada.org/wp-content/uploads/downloads/BOXv7/changelog.txt root@kitploit: Changelog v7.0.46 ----------------- - fix of possible vulnerability as described here...

TFTPlunder

TFTPlunder: un exploit para CVE-2023-29930 Este es un script de exploit para una vulnerabilidad de lectura/escritura ciega de archivos en el servidor de aprovisionamiento TFTP de Genesys anteriormente InIn. Información sobre la vulnerabilidad Esta vulnerabilidad se debe a opciones de configuració...