WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

CVE-2019-9053

CVE-2019-9053 Daniele Scanu 的 SQL 注入漏洞利用代码改进版 已应用以下更改： 新增时间控制变量 -t 或 --time，允许用户延长 SQL 注入的计时（在主机间网络连接存在数据包传输延迟时有用） 添加网络异常处理：在数据包/连接/响应丢失时重试（原版 Python 会抛出异常，需要重新开始） 在获取哈希/盐值时无需使用完整字典，因为其以十六进制表示，因此使用精简字典 0123456789abcdef 以加快速度 Python3 要求 hashlib.md5 参数必须编码，因此哈希查找函数已相应重写 尽情使用吧！...

CVE-2022-45599

CVE-2022-45599 URL de CVE:| https://vulners.com/cve/CVE-2022-45599 ---|--- Reportado por:| TanYeeTat Producto:| Aztech WMB250AC Wireless Mesh Routers Firmware afectado:| Lanzamiento 2020 topaz-linux.lzma.img Descarga de firmware:| código cerrado Manual del producto:...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Resumen El firmware Tenda AC15 V15.03.05.18multi emite una cookie de autenticación en la forma password= y la devuelve sin los indicadores HttpOnly, Secure o SameSite, exponiendo el hash de la contraseña al cliente. El sufijo de baja entropía actúa como un identificado...

CVE-2021-3831

Exploit PHP CVE-2021-3831 Script Resumen Este script PHP está diseñado para interactuar con un sitio web objetivo generando hashes MD5 específicos y realizando solicitudes HTTP para explotar posibles vulnerabilidades. Está destinado únicamente a fines educativos y solo debe utilizarse en entornos...

xpl-ModernWMS-CVE-2024-57698

Divulgación del hash MD5 de la contraseña de administrador - ModernWMS v1.0 - CVE-2024-57698 Un problema en modernwms v.1.0 permite a un atacante ver el hash MD5 de la contraseña del administrador y otros atributos sin autenticación, incluso después de la configuración inicial y el cambio de...

AntiWeb_testing-Suite

ICS/OT AntiWeb: Testing Suite Introducción Una vulnerabilidad ha sido encontrada en aplicaciones web asociadas a ICS/OT que corren sobre servidores Anti-Web hasta su version 3.8.7. La vulnerabilidades que se han identificado afectan a varios fabricantes de renombre en la industria de la...

hassh

"HASSH" - un Método de Perfilado para Clientes y Servidores SSH. "HASSH" es un estándar de huellas digitales de red que se puede utilizar para identificar implementaciones específicas de Cliente y Servidor SSH. Las huellas digitales se pueden almacenar, buscar y compartir fácilmente en forma de u...

CVE-2025-66956

CVE-2025-66956 Control de Acceso Inseguro en los componentes de Contact Plan, E-Mail, SMS y Fax en Asseco SEE Live 2.0 permite a atacantes remotos acceder y ejecutar archivos adjuntos mediante una URL calculable. Vectores CVSS CVSS 3.1: 9.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0:...

hassh

"HASSH": un Método de Perfilado para Clientes y Servidores SSH. NOTA: Este repositorio de Corelight fue creado para que pueda ser mantenido activamente, a petición de Salesforce, cuyo repositorio original no está siendo mantenido. "HASSH" es un estándar de huellas digitales de red que se puede...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd Primero, obtén el hash MD5 de la contraseña de la cuenta 'admin'. Send: GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windo...

CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

GHSA-JH6H-V6MP-H22V milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kvcatalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The...

CVE-2026-42155 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based...

GHSA-2CWR-GCF9-PVXR Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Affected Version: OpenMage LTS ≤ 20.16.0 confirmed on 20.16.0 Affected File: https://github.com/OpenMage/magento-lts/blob/main/app/code/core/Mage/Api/Model/Session.php – start method Summary The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a...

CVE-2026-7103

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file updateuser.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's...

EUVD-2026-24137

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APPKEY, which is exposed i...

PT-2026-33992

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP KEY, which is exposed ...

CVE-2026-23958

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2020-10539

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...