open-sammy

SAMMY Código Abierto v2 Este repositorio aloja la versión de código abierto de SAMMY, la herramienta OWASP SAMM. https://owasp.org/www-project-open-sammy/ Licencia Este proyecto está licenciado bajo la Licencia Creative Commons Attribution-ShareAlike 4.0 International. Consulta el archivo LICENSE...

Poc-CVE-2024-57040

Poc-CVE-2024-57040 CVE-2024-57040 es una vulnerabilidad de seguridad encontrada en ciertos modelos de enrutadores TP-Link TL-WR845N. Específicamente, implica una contraseña "hardcodeada" para la cuenta root del enrutador. Esto significa que una contraseña predeterminada e inmutable está incorpora...

CVE-2020-25078

CVE-2020-25078 使用说明 instructions 攻击url放同一目录下 ip.txt The attack IP is placed in the same directory as ip.txt Terminal log root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt https://xxx.xxx.xxx.xxx:3128 http://xxx.xxx.xxx.xxx:80...

datapower-redis-rce-exploit

datapower-redis-rce-exploit CVE-2020-5014 针对IBM DataPower的认证Redis RCE漏洞利用的概念验证（POC），滥用"测试消息"功能。 Youtube上的完整解释和演示 tomcope.com上的博客文章 说明 通过经过身份验证的会话访问DataPower WebGUI上的"发送测试消息"功能，可以对DataPower内部Redis服务器执行SSRF攻击。内部Redis服务器受密码保护，但似乎使用硬编码密码。然后，可以将此漏洞与现有的Redis...

mcafee_atd_CVE-2019-3663

McAfee ATD CVE-2019-3663 McAfee Advanced Threat Defense ATD 4.6.x 及更早版本 - 硬编码的root密码 安全公告: https://kc.mcafee.com/corporate/index?page=content&id=SB10304 有趣的 shadow 条目 root@kitploit:...

CVE-2024-22853

CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750A1FWv101b03 tiene una contraseña hardcodeada para la cuenta de Alphanetworks, lo que permite a atacantes remotos obtener acceso root a través de una sesión telnet. PoC...

Viessmann Vitogate 300 - Hardcoded Password

A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface. id: CVE-2023-5222 info: name: Viessmann Vitogate 300 - Hardcoded Password author: ritikchaddha severity: critical description: | A critica...

CVE-2022-26138

CVE-2022-26138 1.简介 Confluence Hardcoded Password POC 2.用法 root@kitploit: poc -f host.txt // 批量扫描 poc -h 192.168.1.1 // 单个扫描 3.免责声明 此工具仅用于学习、研究和自查。 不应用于非法目的，请遵守相关法律法规。 使用本工具产生的任何风险与本人无关！...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-55579

CVE-2026-55579 — Pheditor 硬编码默认密码导致远程代码执行 -critical TL;DR： Pheditor（所有版本）在其源代码中嵌入了一个硬编码的默认管理员密码 （admin）。首次登录时没有强制修改密码 ，仅显示视觉警告。任何未认证的攻击者可以以 admin 身份登录，并滥用内置的终端面板 （action=terminal）以 Web 服务器权限执行任意操作系统命令。结合文件上传功能，这导致未认证的远程代码执行（RCE） 。 目录 1. 漏洞概述 2. 根本原因 3. 利用流程 4. 快速开始与复现 5. 影响 6. 修复措施 7. 检测 8. 致谢与免责...

EUVD-2026-78811

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

TOTOLINK X5000R (firmware V9.1.0cu.2415_B20250515) contains a hardcoded root password , granting full network-level access with no authentication required. The vulnerability is rated CVSS 9.8 (Critical) with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment class...

EUVD-2026-77484

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

unknownpwn.github.io

Tecnovision LED Video Wall Vulnerabilities and Exploits. From SQLi to full root access. Introducción: Tecnovision es un fabricante de Video Walls LED utilizados en estadios por ejemplo, Twickenham Stadium, salas de conciertos, centros comerciales, señales de tráfico y mucho más. DlxSpot Player 4 ...

Lockbit-Black-3.0

Lockbit-Black-3.0 La contraseña es: 1234...

CVE-2024-56429

CVE-2024-56429 Acceso a la base de datos local del iLabClient Extraer la contraseña de la base de datos iLabClient utiliza una base de datos Apache Derby para almacenar los datos necesarios localmente. Para garantizar el cifrado, se utiliza un bootPassword para la creación, que puede extraerse de...

CVE-2022-1162

CVE-2022-1162 A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. Exploit: New Gitlab Accounts...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

CVE-2026-90456

CVE-2026-90456 affects a bundled inventory-management component whose example environment-configuration file ships with a fixed, publicly-known administrative password . If a deployment copies this example file into active configuration without running the setup routine that regenerates credentia...

CVE-2026-77012

CVE-2026-77012 affects the 爱采集数据采集和发布插件 (Icollect) WordPress plugin, versions through 1.0.0 . The root cause is a hardcoded default publishing password on an unauthenticated endpoint combined with missing validation of URLs and destination paths. This allows unauthenticated attackers to perform a...