StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-Coded Credentials A critical vulnerability in FreePBX's User Management userman module allows unauthenticated attackers to access the User Control Panel UCP using hard-coded credentials that are embedded during the UCP generic template...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Gladinet CentreStack & Triofox - Hardcoded Credentials

Gladinet CentreStack and Triofox 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise. id: CVE-2025-14611...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

CVE-2022-26138

CVE-2022-26138 POC Description root@kitploit: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with...

credactor

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

CVE-2022-24693

CVE-2022-24693 Description Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. The credentials are stored in the firmware, encrypted by the crypt function...

CVE-2015-7755-POC

CVE-2015-7755-POC CVE-2015-7755 vulnerability detection using ssh to connect those vulnerable version: ScreenOS 6.2.0r15—6.2.0r18，6.3.0r12—6.3.0r20 Juniper Networks user: root passwd: %sun='%s' = %u...

Hikvision-City-Hunter

用于海康威视 IP 摄像头、DVR 和 NVR 的 2025 年终极城市级侦察与利用工具 实时控制台输出 • DVR/NVR 以紫色 高亮 • 摄像头以绿色 显示 • 快照自动下载 • 蜜罐过滤 ╔══════════════════════════════════════════════════════════╗ ║ HIKVISION 2025 ULTIMATE CITY HUNTER ║ ║ Target: New York | Key: admin:12345 ║ ║ DVRs & NVRs = PURPLE | Cameras = Green ║...

TFTPlunder

TFTPlunder: an exploit for CVE-2023-29930 This is an exploit script for a blind file read / write vulnerability in the Genesys formerly InIn TFTP provisioning server. Vulnerability info This vulnerability is due to unrestricted configuration options for the TFTP root path and file extensions. In...

juniper-cve-2015-7755

Juniper CVE-2015-7755 & CVE-2015-7756 This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS. For more information about these issues, please see the URLs below:...

Confluence-Question-CVE-2022-26138-

Confluence-Question-CVE-2022-26138 Atlassian Confluence Server and Data Center: CVE-2022-26138 When the 'Questions for Confluence' app is installed and enabled on Confluence Server or Data Center, it creates a Confluence user account with the username 'disabledsystemuser' and password...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

CVE-2025-45466

CVE-2025-45466 It is the details of CVE-2025-45466 CVE Disclosure: CVE-2025-45466 Summary A vulnerability has been discovered in Unitree Go1 robotic dog all versions using the...

IoT-Vulnerability-Research-Public

Investigación de Seguridad de Hardware y Vulnerabilidades Este repositorio sirve como un archivo público centralizado para mi investigación independiente de vulnerabilidades, auditorías de hardware y Divulgaciones Coordinadas de Vulnerabilidades CVD. Todos los scripts de prueba de concepto,...

HPE-Aruba-AOS8-Vulnerabilities

⚠️ 披露状态： 本仓库中的所有发现已于 2026 年 5 月至 6 月期间 提交至 HPE Networking 漏洞赏金计划（Bugcrowd）。六份提交中有五份 在分类（triage）阶段被标记为“不适用（Not Applicable）”关闭， 且未对提交的证据进行技术性核对。 截至 2026 年 6 月，未发布任何修复。 完整报告来源 https://netacoding.com/posts/ghost-leak/ https://netacoding.com/posts/smurf-reflection/ https://netacoding.com/posts/xxe-ssrf...