ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227 CVE-2024-25227 Exploit CVE-2024-25227 is a ABO.CMS 5.8 SQLi vulnerability found in the parameter "tblogin" PoC: POST /login.aspx HTTP/1.1 Host: localhost Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

prepos-login-checker

prepos-login-checker Python 2.7 Feature Acc Login Checker Save Premium Result Only Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Run? Create a list.txt file or anything in txt form Format List url:user:pass Install Python 2.7 Download Here python file.py Disclaimer !!! I have...

CVE-2017-7921

CVE-2017-7921 CVE-2017-7921 is a critical vulnerability CVSS score: 9.8 affecting multiple Hikvision IP camera and DVR models, first disclosed in 2017. It stems from an improper authentication flaw that allows unauthenticated remote attackers to bypass login mechanisms and gain unauthorized acces...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 🚨 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 📝 Description The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.4.01. This flaw...

CVE-2026-88785

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-84737

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

EUVD-2026-96773

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-88785

The Simple Membership WordPress plugin, in versions before 4.8.3 , is vulnerable to credential exposure. When the optional auto-login-after-registration feature is enabled, the plugin transmits a newly registered member's plaintext password within a URL query string . This exposure allows anyone ...

EUVD-2026-96761

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84734 Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin (version 1.0 and below ) is vulnerable to an unauthenticated administrator account takeover . The root cause is a failure to correctly validate a request value against the visitor's session before authentication, specifically involving the 'mql_pass' par...

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass Educational PoC This repository provides an educational proof of concept for CVE-2026-9198 affecting IBM Langflow OSS. The PoC poc.py demonstrates how an unauthenticated attacker can chain: 1. GET/POST /api/v1/autologin return...

CVE-2024-24139

CVE-2024-24139: Login System with Email Verification SQL Injection Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24139.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24139/blob/main/CVE-2024-24139.md...

web-brutator

Web Brutator Bruteforce rápido y modular de interfaces web 📥 Instalación python3 -m pip install -r requirements.txt ⏩ Uso $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /| /|| /...

CVE-2026-108522

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108522

The Studio-Saelix Sencho software (up to version 0.94.1 ) contains a vulnerability in the Login Endpoint (specifically affecting the /api/auth/login file). The root cause is that the login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing ...

CVE-2026-108522 Studio-Saelix Sencho Login Endpoint login improper authentication

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108522

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...