87142 matches found
EUVD-2026-94448
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2026-20328
A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) allows an unauthenticated, remote attacker to gain unauthorized access. The root cause is improper checks during the password reset process. By sending a malicious reque...
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2012-2122-Home-Lab
ENGLISH BELOW CVE-2012-2122 MySQL Authentication Bypass Home Lab Lab ΰΈΰΈ΅ΰΉΰΉΰΈΰΉΰΈΰΈΰΈ±ΰΈ§ΰΈΰΈ’ΰΉΰΈ²ΰΈΰΈͺΰΈ²ΰΈΰΈ΄ΰΈΰΈΰΉΰΈΰΈΰΉΰΈ«ΰΈ§ΰΉ CVE-2012-2122 - MySQL Authentication Bypass ΰΉΰΈΰΈ΄ΰΈΰΈΰΈ²ΰΈΰΈΰΉΰΈΰΈΰΈ΄ΰΈΰΈΰΈ₯ΰΈ²ΰΈΰΉΰΈΰΈΰΈ²ΰΈ£ΰΉΰΈΰΈ£ΰΈ΅ΰΈ’ΰΈΰΉΰΈΰΈ΅ΰΈ’ΰΈΰΈΰΉΰΈ²ΰΈ£ΰΈ«ΰΈ±ΰΈͺΰΈΰΉΰΈ²ΰΈΰΉΰΈ MySQL ΰΉΰΈ§ΰΈΰΈ£ΰΉΰΈΰΈ±ΰΈ 5.5.23 ΰΈ«ΰΈ£ΰΈ·ΰΈΰΈΰΉΰΈ³ΰΈΰΈ§ΰΉΰΈ² ΰΉΰΈ‘ΰΈ·ΰΉΰΈΰΈΰΈΉΰΉΰΉΰΈΰΈ‘ΰΈΰΈ΅ΰΈͺΰΉΰΈΰΈ£ΰΈ«ΰΈ±ΰΈͺΰΈΰΉΰΈ²ΰΈΰΈΰΈ΄ΰΈΰΈΰΉΰΈ³ ΰΉ ΰΈ«ΰΈ₯ΰΈ²ΰΈ’ΰΈΰΈ£ΰΈ±ΰΉΰΈ MySQL...
EUVD-2026-94402
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...
CVE-2025-63314
CVE-2025-63314 - Improper Password Reset Token Handling in Acora CMS Discovered by Joby Y Daniel from Crowe India π Overview DDSN Interactive cm3 Acora CMS version 10.7.1 contains a security vulnerability in its password reset functionality. The application uses a static and persistent password...
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation FBI and Secret Service USSS on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer SSL virtual private network VPN gateways. "The campaign...
Improper Access Control
Payload is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of the access.update restriction, which allows an attacker with appropriate access to bypass the restriction and modify a user's password...
CVE-2020-1472
CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...
CVE-2022-46484
CVE-2022-46484 Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys...
GoFileX
GoFileX Late-90s IRC-client TUI for walking wordlists against a password-protected GoFile share. It talks only to the documented REST API and treats rate limits as a hard rule: sequential requests, a conservative default interval, exponential cooldown on 429 / error-rateLimit, and an automatic...
CVE-2026-104667
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...
CVE-2026-104953
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
CVE-2023-51119
CVE-2023-51119 Improper Access Control on D-Link DIR-605L router Exploitation explanation: Due to an incorrect access control, a takeover can be done over the admin account without any kind of authentication sending a request under special circumstances only needs a legitimate admin to be logged ...
CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...
CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...