St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 Una vulnerabilidad de cross-site scripting XSS reflejado en /authenticationendpoint/login.do de WSO2 Api Manager por debajo de v4.2.0 permite a los atacantes ejecutar scripts web arbitrarios o HTML a través de un payload manipulado inyectado en el parámetro...

HTC

Hack The CCTV DVRs Credentials Exposed | CVE-2018-9995 | The CCTV Leaked Username For Get Loggin Access How To Use? Open The https://www.zoomeye.org/ Search This Keyword '/login.rsp' Wait To Get IP and Port $ python3 thecctv.py More Information OS | Language | Contact ---|---|--- Linux Ubuntu |...

CVE-2024-54820

Vulnerabilidad: Inyección SQL no autenticada - Volcado de credenciales en texto claro Autor : Javier Carabantes Software afectado : XOne Web Monitor Software : https://xone.es/ Versión afectada : 02.10.2024.530 framework 1.0.4.9 Descripción Se ha descubierto una vulnerabilidad de inyección SQL no...

CVE-2025-10294

Exploit: Bypass de autenticación mediante ownidsharedsecret vacío falsificación de JWT 1 Forjar un JWT válido usando una clave HMAC vacía SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

CVE-2024-57610

Falta de limitación de tasa en Sylius v2.0.2 Página de inicio del proveedor: https://sylius.com/ Pasos para reproducir 1. Navegue a https://store.sylius.com/login 2. Intente múltiples solicitudes de inicio de sesión utilizando herramientas o scripts automatizados por ejemplo, Burp Suite, cURL. 3...

CVE-2026-36959

CVE-2026-36959: Falta de Limitación de Velocidad en el Endpoint de Inicio de Sesión ID CVE: CVE-2026-36959 Fecha: 2026-04-29 Descubridor: Kirubel Solomne Proveedor: U-SPEED Producto: Router U-SPEED Versión de Firmware: V1.0.0 CWE: CWE-307 - Restricción Inadecuada de Intentos de Autenticación...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit El plugin WP Directory Kit para WordPress es vulnerable a un bypass de autenticación en todas las versiones hasta la 1.4.4 inclusive debido a una implementación incorrecta del algoritmo de autenticación en la funciónwdkgenerateautologinlink. Esto se debe a que la...

CVE-2025-60375

CVE-2025-60375 — Omisión de Autenticación en PerfexCRM ID de Aviso: perfexcrm-auth-bypass-2025 CVE: CVE-2025-60375 Producto: PerfexCRM Versiones afectadas: versiones anteriores a 3.3.1 3.3.1 Reportado por: Ajansha Shankar, Ahamed Yaseen Referencias: OWASP Authentication Cheat Sheet —...

CVE-2024-7591-PoC

CVE-2024-7591-PoC Estos scripts PoC en Python prueban el Kemp LoadMaster para detectar ejecución remota de código. ESTA HERRAMIENTA ESTÁ DISEÑADA SOLO CON FINES DE PRUEBA Estos scripts se basaron en el artículo de Marius Walter sobre los detalles de este exploit. Puedes leer su publicación en:...

CVE-2026-9082

CVE-2026-9082 Inyección SQL no autenticada en Drupal Core sobre PostgreSQL mediante POST /user/login, escalada a ejecución remota de código a través de sessionpreloadlibraries de PostgreSQL. A diferencia de los exploits públicos existentes que apuntan a JSON:API, este utiliza el endpoint de inici...

CVE-2026-102248

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

EUVD-2026-88625

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-102248 Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-102248

A vulnerability exists in the Login Endpoint component of Rebuild up to versions 4.4.7/4.5.0-beta5 . The flaw is located within an unspecified part of the /user/login file and results in improper authentication . Attackers can initiate this attack remotely . While the exploit is publicly availabl...

CVE-2026-102248 Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

UBUNTU-CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

CVE-2026-101333 Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

CVE-2026-101333

A flaw in the Micrometer user-event metrics listener of Keycloak , an identity and access management solution, allows an unauthenticated attacker to create an unlimited number of metric time series. This occurs when the listener is configured to include the idp tag and an attacker sends requests ...