CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

EUVD-2026-82685

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

wordpress-bf

wordpress-bf Esta es una herramienta para enumerar los autores de un sitio web de blog de WordPress e intentar forzar por fuerza bruta los inicios de sesión. No está completa, pero funciona. Si encuentras código horrible, ¡envía un PR para corregirlo! Escribirá la URL, el usuario y la contraseña ...

grafana-bruteforce

grafana-bruteforce Una herramienta que toma una lista combinada de nombres de usuario y contraseñas e intenta realizar fuerza bruta en la página de inicio de sesión de Grafana. Grafana te bloqueará después de 5 intentos, por lo que debes asegurarte de que tu proxy tenga múltiples IP externas. Cóm...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page input...

nexphisher

项目不再维护。请使用ZPhisher 安装： apt update apt install git -y git clone git://github.com/htr-tech/nexphisher.git cd nexphisher 设置：bash setup 设置 Termux：bash tmuxsetup 运行：bash nexphisher 单行命令： root@kitploit: apt update ; apt install git -y ; git clone git://github.com/htr-tech/nexphisher.git ; cd nexphisher...

CVE-2017-14980

🐞 CVE-2017-14980: Sync Breeze Enterprise 10.0.28 - Desbordamiento de búfer basado en pila Desbordamiento de búfer basado en pila en Sync Breeze Enterprise 10.0.28 accesible a través del manejador /login, que demuestra cómo una longitud de entrada sin verificar puede corromper la memoria de la pil...

Linux Distros Unpatched Vulnerability : CVE-2026-90413

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but...

EulerOS Virtualization 2.11.1 : util-linux (EulerOS-SA-2026-3479)

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifical...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 Vulnerabilidad de Indexación de Directorios Descripción La Indexación de Directorios en el Portal de Inicio de Sesión de TOTOLINK-A702R-V1.0.0-B20161227.1023 permite a un atacante acceder a los directorios /icons/ a través del parámetro GET...

CVE-2025-10294

漏洞利用：通过空的 ownidsharedsecret 绕过认证（JWT伪造） 1 使用空HMAC密钥伪造有效的JWT root@kitploit: SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header = b64ujson.dumps"typ":"JWT","alg":"HS256", separators=",",":".encode...

Owa-Valid-Login-Checker

Owa-Valid-Login-Checker Python 2.7 Cómprame un café : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC ¿Cómo instalar Python ??? Instala Python 2.7.16 / 2.7.17 Instala pip : pip install requests pip install colorama pip install futures ¿Cómo ejecutar ??? Lista de ejemplo site.com/owa/|user|pass...

laf

laf Un script en Python que escanea en busca de paneles de administración/inicio de sesión en un host o lista de hosts determinada. root@kitploit: usage: laf.py -h -d host -l hostfile|- -sys system -c cookie -u user -da -p pass -ic -k -v Find admin/login panel for a single host -d or a list of...

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point h...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

DEBIAN-CVE-2026-90413

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

AZL-101978 CVE-2026-90413 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

CVE-2026-90413

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isertloginrecvdone records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...