cuddlephish

CuddlePhish Вооружённый многопользовательский «браузер-в-середине» BitM для пентестеров. Эта атака может быть использована для обхода многофакторной аутентификации во многих критически важных веб-приложениях. Она работает даже для приложений, которые не используют сессионные токены и,...

TREVORspray

TREVORspray 2.0 TREVORspray는 스레딩, SSH 프록시, 전리품 모듈 등을 갖춘 모듈형 비밀번호 스프레이 도구입니다! 제작: @thetechr0mancer 설치: root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray 함께 제공되는 블로그 포스트에서 재미있는 글과 멋진 데모를 확인하세요! 기능...

CVE-2023-23192

CVE-2023-23192 CVE-2023-23192- Userlock - Multi-Factor Authentication MFA Bypass Exploit Title: Userlock - Multi-Factor Authentication MFA Bypass Date: 01/11/2023 Exploit Author: Pinar Sadioglu Vendor Homepage: https://www.isdecisions.com/products/userlock/help/ Version: = 11.0.1.40 Tested on:...

CVE-2026-48558

CVE-2026-48558: Обход аутентификации OIDC в SimpleHelp !WARNING Этот код предоставляется как есть, только для образовательных и исследовательских целей. Не используйте этот PoC в производственных системах, в средах общего доступа или против любых несанкционированных целей. Эта эксплойт-программа...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 WordPress MFA 우회 - 익스플로잇 랩 이 저장소는 WordPress에서 CVE-2024-10924 취약점을 악용하여 이중 인증MFA을 우회하고 WordPress 관리 패널에 접근하기 위한 랩을 제공합니다. 전제 조건 이 랩을 환경에 배포하려면 아래 단계를 따르세요: VMware에 WordPress 배포 LAB의 zip 파일을 압축 해제한 후, VMWare에서 Open을 클릭하여 머신을 가져와야 합니다. Ubuntu-Bypass-MFA-Wordpress.vmx라는 파일을 선택하고, 마지막으로...

CVE-2025-67070-Intelbras-CFTV-MFA-Bypass

Intelbras NVD 9032 R Ftd – 严重密码重置漏洞 发现者：Theo Cia CVE：CVE-2025-67070 状态：已报告给厂商 发现日期：2025年11月 影响：通过绕过 MFA 获得完全管理访问权限 固件：V2.800.00IB00C.0.T 构建日期：2022-08-17 概要 Intelbras NVD 9032 R Ftd IP CFTV 设备中存在一个严重漏洞，攻击者可在密码恢复过程中绕过多因素认证。这导致攻击者能够更改管理员密码并获得管理面板的完全访问权限。 漏洞详情 受影响组件：密码恢复端点 漏洞类型：访问控制不当 CWE-284 攻击途径：基于...

CVE-2026-77567

CVE-2026-77567 affects Filament , a full-stack component library for Laravel development. Prior to versions 4.12.0 and 5.7.0 , incorrect challenge-form required-field handling allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. Email-based MFA is not...

CVE-2025-3639

CVE-2025-3639 PoC - Обход аутентификации Liferay Portal/DXP Этот репозиторий содержит Proof of Concept PoC для CVE-2025-3639 — уязвимости обхода аутентификации в Liferay Portal версии 7.3.0–7.4.3.132 и Liferay DXP различные версии от 2024.Q1 до 2025.Q1.6. PoC демонстрирует, как...

joombrute

JoomBrute Современный набор инструментов для атаки на аутентификацию Joomla J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227 Описание Набор инструментов для атаки на учётные данные Joomla, охватывающий версии CMS 3, 4 и 5. Шесть подкоманд реализуют полную цепочку атак «от начала до...

CVE-2024-10924-PoC

PoC 인증 우회 MFA Really Simple Security WordPress 플러그인 | CVE-2024-10924 워드프레스 웹 페이지에 접속하면 취약한 플러그인을 통해 MFA가 활성화되어 있는 것을 볼 수 있습니다: PoC를 실행하고 접속 데이터를 제공해야 합니다: 자동으로 관리자 패널 내의 임시 .html 파일을 통해 브라우저가 열립니다. 이 시나리오를 재현할 취약한 환경을 자동으로 배포하려면 다음 저장소를 사용할 수 있습니다:...

EUVD-2026-61029

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-73337

Joomla! Core versions 4.0.0–5.4.7 and 6.0.0–6.1.2 contain an insufficient state-check flaw in MFA authentication, allowing 2FA bypass (CVSS 8.2 HIGH, integrity impact). No exploitation or patch version details are provided in the documents.

CVE-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

PT-2026-77197

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

BIT-OPENBAO-2025-55001 OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. Whe...

CVE-2026-10697

The CVE-2026-10697 issue affects Progress MOVEit Transfer (pre-2025.1.5 and 2026.0.0–2026.0.2). The vulnerability is described as an Improper Authentication that may allow bypassing authentication, with confirmed impact on confidentiality, integrity, and availability (all HIGH). Core details from...

CVE-2026-22049

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bashhistory. From that one lapse, French security firm Lexfo...

CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...

PT-2026-57282

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0 Description The Account Center step-up check accepts any active verification record belonging to the current user where isVerified is set to true. An attacker with an existing Account API bearer token can create...