POC-CVE-2022-30600

Доказательство концепции для CVE-2022-30600 Обзор Этот репозиторий содержит 2 реализации доказательства концепции, которое эксплуатирует CVE-2022-30600. CVE-2022-30600 — это уязвимость безопасности, которая позволяет злоумышленнику обойти порог блокировки учетной записи в веб-приложении moodle. К...

CVE-2022-31007-Python-POC

Python automation of the following write up on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0. Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electron...

Spray365

Что такое Spray365? Spray365 — это инструмент для перебора паролей, который определяет действительные учетные данные для учетных записей Microsoft Office 365 / Azure AD. Чем Spray365 отличается от множества других доступных инструментов для перебора паролей? Spray365 позволяет выполнять перебор...

iDict

면책 조항: 이 코드는 나에게 크레딧@Pr0x13을 표시하는 한 원하는 대로 사용해도 됩니다. 사용하기 전에 해당 국가에서 이 도구를 사용하는 것이 합법인지 확인하세요. 나는 누구의 iCloud 계정이나 iDevice에 발생한 어떠한 손해에 대해서도 책임지지 않습니다. 이 글을 작성하면서 어떤 계정도 익스플로잇하지 않았으며, 테스트조차 하지 않았습니다 잘 작동하기를 바랍니다 lol. 나는 단지 관찰하고 보고했을 뿐입니다. 설치: Xampp 설치 폴더의 HtDocs 폴더에 넣으세요. 사용 중인 OS에 맞게 cUrl을 설치하세요 ...

CVE-2026-1199

A flaw was found in Zabbix. The API and Frontend login lockout mechanism does not properly count several unsuccessful login requests if they are sent simultaneously. This oversight allows a remote attacker to bypass the intended lockout counter, potentially enabling more password guesses than...

CVE-2026-84461

The Zammad open-source helpdesk and customer support system is vulnerable to password brute-forcing in versions prior to 7.1.2 . The issue exists within the two-factor login step , where the system fails to trigger normal lockout or rate limiting, allowing an attacker to make unlimited password g...

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

GHSA-32GC-64M7-HJ7V 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

EUVD-2026-84542

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

EUVD-2026-84112

@sync-in/server vulnerable to TOTP Brute-Force via POST /api/app/sync/register...

GHSA-274F-6W77-8QM9 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP socket...

Astra Linux – Vulnerability in Tomcat9

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protections provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

PT-2026-89299

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...