cve-2019-17240

Bludit = 3.9.22 - Bruteforce Mitigation Bypass This is small project where I rewrite this python script into golang. Purpose of this project was to learn Golang and understand how this exploit work. Usage root@kitploit: $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of...

CVE-2025-505050

CVE-2025- Des: unauthinticated access to uploaded files POC: navigate to any uploaded file it will be accesed without login Discovered by Aljohara Abdulmohsen Alsubaie...

CVE-2026-86084 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an...

CVE-2026-33017-langflow-rce

CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution RCE Overview CVE ID: CVE-2026-33017 Affected Software: Langflow Vulnerable Versions: = 1.9.0 Severity: Critical Author: r3nsi15 Date: 2026 Description Langflow exposes a public flow build endpoint /api/v1/buildpublictmp/flowID/flow...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

commend_sqli

CVE-2023-XXXXX Suggested description G8-VOIPREC Commend VoIPRec web interface is vulnerable to time-base blind SQL injections in "Code" parameter on login page. Additional Information PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0...

CVE-2026-24061-Telnetd

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass CVE: CVE-2026-24061 Severity: Critical CVSS: 9.8 Critical CWE: CWE-88 — Improper Neutralization of Argument Delimiters in a Command Affected Component: GNU Inetutils telnetd Affected Versions: 1.9.3 through 2.7 Overview CVE-2026-24061 is ...

CVE-2020-15367

CVE-2020-15367 Brute Force on Supravizio BPM 10.1.2 Description Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page. Exploitation To exploit th...

CVE-2021-46366

CVE-2021-46366: Credential Bruteforce Attack via CSRF + Open Redirect in Magnolia CMS An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery CSRF in order to brute force and exfiltrate users'...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

CVE-2026-79577

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

CVE-2026-33920

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

EUVD-2026-72784

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

mysql_dos

This tool crashes vulnerable MySQL servers using CVE-2017-3599, a remote integer overflow when parsing login credentials. It can be downloaded here you will need to run it from the command line Usage: mysqldos target port...

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

DAEnetIP4 METO v1.25 - Session Hijacking

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. id: CVE-2025-28242 info: name: DAEnetIP4 METO v1.25 - Session Hijacking author: 0xAkoko severity: high...