cve-2026-8697

CVE-2026-8697: Omisión del Límite de Tasa de Inicio de Sesión en TP-Link Archer C64 CVE-2026-8697 es un fallo lógico en el sistema operativo del TP-Link Archer C64 llamado TPOS en el mensaje de depuración. Permite a cualquier usuario no privilegiado conectado al router omitir el límite de tasa de...

requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descripción : Omisión del límite de peticiones que conduce a la omisión de 2FA Versión probada : 2.7.0 Tipo de ataque: Remoto Impacto : Omisión de 2FA Proveedor del producto : https://www.discourse.org Información adicional : Discourse es una plataforma de...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticación en Kaiten Kaiten - un sistema de gestión de flujos de trabajo. Una vulnerabilidad en Kaiten permite a los atacantes omitir el mecanismo de autenticación por código PIN. La aplicación requiere que los usuarios ingresen un código PIN de 6 dígitos enviado a su...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass del límite de tasa por alias en GraphQL Batching Código del programa exploit en Node.js + Python // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema =...

goop

goop Google 搜索抓取器 注意： 该工具已不再可用。我曾向谷歌团队报告过此问题，他们告知我这不是一个合理的问题，但现在他们只是默默修复了它。 目录 简介 工作原理 使用方法 安装 示例 法律声明与免责 简介 goop 可以执行 Google 搜索而不会被 CAPTCHA 拦截或遭受任何速率限制。 工作原理 Facebook 为其抓取器提供了一个调试器工具。 有趣的是，Google 并不会限制该调试器发出的请求（白名单？），因此它可以用来抓取 Google 搜索结果而无需绕过 CAPTCHA。 由于涉及 Facebook，每次请求时必须向库提供 Facebook 会话 Cooki...

xmlrpc-brute

Herramienta de Fuerza Bruta XML-RPC para WordPress Una herramienta diseñada para probar sitios WordPress en busca de vulnerabilidades XML-RPC mediante intentos de fuerza bruta de credenciales de usuario a través de la interfaz XML-RPC. Descripción Esta herramienta prueba instalaciones de WordPres...

CVE-2016-16113-POC

Obtén RCE - Exploit de Bludit CMS | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| Una herramienta de explotación automatizada que combina CVE-2019-17240 bypass de autenticación y CVE-2019-16113 carga arbitraria de archivos para lograr ejecución...

CVE-2014-0195

Script de Explotación de Fuerza Bruta XML-RPC para WordPress Este repositorio contiene una prueba de concepto PoC basada en Python para realizar ataques de fuerza bruta a credenciales de inicio de sesión en instancias de WordPress vulnerables a CVE-2014-0195, donde la función system.multicall de...

CVE-2024-25277

CVE-2024-25277 discovered on MW45APT02.0002 Resources and PoCs This repo serves as collection of scripts and PoCs gathered during analysis and discovery of CVE-2024-25277. You can read more about the finding on:...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

WordPress wpForo Forum plugin 3.0.0-3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability

Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability discovered by Usama Arshad in WordPress Plugin wpForo Forum versions 3.0.0-3.1.5...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514

The wpForo Forum WordPress plugin (versions 3.0.0 through 3.1.5 ) is vulnerable to unauthenticated AI credit exhaustion . The root cause is a failure to verify the source of client-supplied IP address headers, which are used to key the per-visitor rate limit on paid AI requests. An attacker can b...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

EUVD-2026-86626

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...