Lucene search
+L

37220 matches found

EUVD
EUVD
added 2026/09/08 1:57 p.m.6 views

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

5.1CVSS0.00099EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/08 1:17 p.m.6 views

EUVD-2026-72784

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

7.6CVSS0.0039EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/08 10:40 a.m.8 views

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

9.8CVSS7.7AI score0.87892EPSS
SaveExploits17
Nuclei
Nuclei
added 2026/09/08 9:47 a.m.74 views

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

3.7CVSS5.2AI score0.00816EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/08 9:47 a.m.15 views

DAEnetIP4 METO v1.25 - Session Hijacking

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. id: CVE-2025-28242 info: name: DAEnetIP4 METO v1.25 - Session Hijacking author: 0xAkoko severity: high...

9.8CVSS5.9AI score0.01825EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/08 8:37 a.m.7 views

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticated Admin Takeover | CVSS 9.8 | Ready to use 🔥 What you get Fully working Python exploit for CVE-2026-8732 Unauthenticated administrator account creation Returns magic login URL – instant site takeover Works against WP Maps Pro ≤ 6.1.0...

9.8CVSS6.2AI score0.22728EPSS
SaveExploits8
Patchstack
Patchstack
added 2026/09/08 8:12 a.m.4 views

WordPress SureCart plugin < 4.7.0 - Unauthenticated Account Creation with Automatic Login vulnerability

Unauthenticated Account Creation with Automatic Login vulnerability discovered by Jakub Herman in WordPress Plugin SureCart versions 4.7.0...

6.5CVSS0.00164EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
added 2026/09/08 7:42 a.m.5 views

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

9.3CVSS5.9AI score0.00511EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/08 2:22 a.m.5 views

CVE-2025-10035

CVE-2025-10035 How does this detection method work? Detects vulnerable GoAnywhere MFT instances by extracting version numbers from the login page and matching against affected version ranges. How do I run this script? 1. Download Nuclei from here 2. Copy the template to your local system 3. Run t...

10CVSS8.4AI score0.99799EPSS
SaveExploits3References1
CVE
CVE
added 2026/09/08 2:04 a.m.26 views

CVE-2026-19397

CVE-2026-19397 is a missing authentication vulnerability in ASUS Control Center Express Agent . When the host has an active login session, an unauthenticated user on the adjacent network can directly connect to the agent and control the host. The flaw affects a critical function within the agent ...

7.7CVSS0.00205EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/08 12:00 a.m.7 views

EUVD-2026-72850

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

0.00139EPSS
SaveExploits0References1
NOZOMI
NOZOMI
added 2026/09/08 12:00 a.m.6 views

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

5.1CVSS0.00099EPSS
SaveExploits0Affected Software2
CVE
CVE
added 2026/09/08 12:00 a.m.13 views

CVE-2026-79577

CVE-2026-79577 affects the /cas/login component of sso-master v1.0.0 , allowing an unauthenticated remote attacker to authenticate into the application by sending a crafted POST request that bypasses the password check. This yields a CVSS 3.1 score of 9.8 (Critical) with high impact across confid...

9.8CVSS0.00139EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/08 12:00 a.m.27 views

CVE-2026-79577

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

0.00139EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/08 12:00 a.m.9 views

CVE-2026-79576

Digital-Infrastructure v9.6.7 has a vulnerability in its Single-Sign On (SSO) component that allows an unauthenticated, remote attacker to authenticate as any user, including the Admin, without a password . The flaw is network-exploitable with no user interaction or prior privileges required, rat...

9.8CVSS0.00334EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/07 6:10 p.m.7 views

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

9.8CVSS8AI score0.04348EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/07 3:43 p.m.7 views

CVE-2024-28999

CVE-2024-28999 Exploit for CVE-2024-28999 SolarWinds Platform Race Condition Vulnerability - login page The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console login page Technical Details:...

7.5CVSS7AI score0.13913EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/07 3:26 p.m.9 views

CVE-2021-26088

PoC para CVE-2021-26084 escrito en PowerShell Descripción Una vulnerabilidad de autenticación inadecuada en FSSO Collector puede permitir que un usuario no autenticado eluda cualquier regla de autenticación del firewall y acceda a la red protegida mediante el envío de paquetes UDP de notificación...

9.8CVSS7.8AI score0.99999EPSS
SaveExploits46
NVD
NVD
added 2026/09/07 2:16 p.m.4 views

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

7.5CVSS0.00214EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/07 1:28 p.m.6 views

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

7.5CVSS0.00214EPSS
SaveExploits0References2
Rows per page
Query Builder