requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2024-41276

CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

PoC-ubuntutouch-pin-privesc

UPDATE 09.09.2022 I got new CVE for this vulnerability: CVE-2022-40297. Proof of Concept: Privilege escalation in Ubuntu Touch 16.04 - by Passcode Bruteforce Ubuntu Touch allows you to "protect" devices with a 4-digit passcode. Such a code was set in a demonstration device. The problem is that th...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2014-0195

XML-RPC WordPress Brute-Force Exploit Script This repository contains a Python-based proof of concept PoC for brute-forcing login credentials on WordPress instances vulnerable to CVE-2014-0195, where the XML-RPC system.multicall function can be exploited to attempt multiple login requests in a...

CVE-2024-25277

CVE-2024-25277 discovered on MW45APT02.0002 Resources and PoCs This repo serves as collection of scripts and PoCs gathered during analysis and discovery of CVE-2024-25277. You can read more about the finding on:...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

CVE-2023-38545-POC

CVE-2023-38545 POC for the curl command line tool This POC is based on the earlier POC created by UTsweetyfish, shared in this repository:https://github.com/UTsweetyfish/CVE-2023-38545. Contrary to that POC, this one is for the commandline tool and not the libcurl library, and doesn't require...

cve-2026-8697

CVE-2026-8697: Login Rate Limit Bypass on TP-Link Archer C64 CVE-2026-8697 is a logic flaw in the TP-Link Archer C64's OS called TPOS in the debug message. It lets any unprivileged user connected to the router to bypass the web UI rate limit by using a residual SSH service. A simple Python script...

openclaw-dashboard

Panel de Control del Agente OpenClaw Un panel de monitoreo en tiempo real, seguro y atractivo para agentes OpenClaw. Rastrea sesiones, monitorea el uso de la API, visualiza costos, gestiona archivos de memoria y mantén un seguimiento de la salud del sistema, todo en un solo lugar. Capturas de...

waymore

Acerca de - v8.9 La idea detrás de waymore es encontrar aún más enlaces de Wayback Machine además de otras fuentes que otras herramientas existentes. 👉 La mayor diferencia entre waymore y otras herramientas es que también puede descargar las respuestas archivadas para las URLs en Wayback Machine ...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Description : Rate limit Bypass which leads to 2FA Bypass Tested Version : 2.7.0 Attack Type: Remote Impact : 2FA Bypass Vendor of Product : https://www.discourse.org Additional Information : Discourse is discussion platform built for the next decade of the...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

CVE-2026-108162

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

EUVD-2026-96317

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

CVE-2026-108162 Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

CVE-2026-108162

Pingvin Share X versions before 1.22.0 are vulnerable to a rate limit bypass because the application's backend/src/main.ts unconditionally trusts proxy headers. This allows unauthenticated remote attackers to evade per-IP throttling by rotating spoofed X-Forwarded-For values. Attackers can target...

CVE-2026-108162 Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...