CVE-2026-54433

CVE-2026-54433: Roundcube plain-text email stored XSS This repository contains a configurable Python proof of concept for CVE-2026-54433 , a stored cross-site scripting vulnerability in Roundcube's plain-text email renderer. An unauthenticated sender can deliver a crafted text/plain message. When...

ctf

CTF Related stuff Table of Contents The challs are linked in the table below. Description| Event/Game| Solution ---|---|--- Smash The Stack| ---| --- Blackbox| Level 1| An exe with a "login" functionality with the password in plain text in the memory. Blackbox| Level 2| An exe with setuid for...

CVE-2022-42176

PCSecure V5.0.8.xw - Use of Hard-coded Credentials in configuration files leads to admin panel access Summary Vendor: PCTechSoft SAS Product: PCSecure Affected versions: 5.0.8.xw CodeName: PapiQuieroPollo00 Vulnerability Type: Use of Hard-coded Credentials CWE-798 CVSSv3.1 Vector:...

smb

███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB is a network protocol that allows sharing files, printers and other resourc...

CVE-2018-14847

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. Blogpost https://n0p.me/winbox-bug-dissection/ Requirements Python 3+ This script will NOT run with Python 2.x or lower. How To Use The script...

CVE-2025-63820

CVE-2025-63820 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Vulnerability details When logging into the control panel, the username and password are sent in plain-text:...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383 Vulnerability Description: During the security assessment of the Router firmware, it was observed that sensative information regarding the devices connected to router such as Mobile phone,Laptos, Tablets is...

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extracting-User-credentials-For-Hathway-Router Via SPI flash-CVE-2024-44815 Vulnerability Description: During the security assessment of the Router firmware, it was observed that router login credentials of both web portal and Wi-Fi access point are stored in plain text in SPI flash memoey...

WinboxPoC

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and updat...

CVE-2026-111248

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

CVE-2026-111248

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

EUVD-2026-121235

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

CVE-2026-118380

In MIT krb5 release 1.4 and later, an active network attacker can alter the arguments sent by a legitimate client to RPC services protected by RPCSECGSS, or cause return values to be sent in plain text. Mitigation If remote administration of the Kerberos Key Distribution Center KDC is not require...

PT-2026-141730

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

CVE-2026-111248: Apache Software Foundation Apache TomEE: The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored…

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

EUVD-2026-117815

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...

CVE-2026-111491

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...

CVE-2026-111491 Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...

CVE-2026-111491 Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...