277 matches found
requests-ip-rotator
Orgullosamente patrocinado por Swiftproxy Proxies residenciales de alto rendimiento con un grupo de más de 80 millones de IPs en más de 195 países — mejore las tasas de éxito de las solicitudes y reduzca los bloqueos de IP durante la recolección de datos a gran escala y la automatización de...
CVE-2024-41276
CVE-2024-41276 Bypass de Autenticación en Kaiten Kaiten - un sistema de gestión de flujos de trabajo. Una vulnerabilidad en Kaiten permite a los atacantes omitir el mecanismo de autenticación por código PIN. La aplicación requiere que los usuarios ingresen un código PIN de 6 dígitos enviado a su...
batchql
BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...
xmlrpc-brute
Herramienta de Fuerza Bruta XML-RPC para WordPress Una herramienta diseñada para probar sitios WordPress en busca de vulnerabilidades XML-RPC mediante intentos de fuerza bruta de credenciales de usuario a través de la interfaz XML-RPC. Descripción Esta herramienta prueba instalaciones de WordPres...
CVE-2014-0195
Script de Explotación de Fuerza Bruta XML-RPC para WordPress Este repositorio contiene una prueba de concepto PoC basada en Python para realizar ataques de fuerza bruta a credenciales de inicio de sesión en instancias de WordPress vulnerables a CVE-2014-0195, donde la función system.multicall de...
CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...
CVE-2016-16113-POC
Obtén RCE - Exploit de Bludit CMS root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| Una herramienta de explotación automatizada que combina CVE-2019-17240 bypass de autenticación y CVE-2019-16113 carga arbitraria de archivos para...
CVE-2024-25277
CVE-2024-25277 descubierto en MW45APT02.0002 Recursos y PoCs Este repositorio sirve como colección de scripts y PoCs recopilados durante el análisis y descubrimiento de CVE-2024-25277. Puedes leer más sobre el hallazgo en:...
CVE-2021-3138
..| Discourse 2.7.0 - CVE-2021-3138 |.. Description : Rate limit Bypass which leads to 2FA Bypass Tested Version : 2.7.0 Attack Type: Remote Impact : 2FA Bypass Vendor of Product : https://www.discourse.org Additional Information : Discourse is discussion platform built for the next decade of the...
EUVD-2026-68230
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
CVE-2026-82643
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...
CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...
CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass
3. CVE-2026-11103 – Bypass del Rate Limit tramite Alias nel Batching GraphQL Codice del programma Node.js + Exploit Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchem...
cve-2026-8697
CVE-2026-8697: Bypass del limite di tentativi di accesso su TP-Link Archer C64 CVE-2026-8697 è un difetto logico nel sistema operativo del TP-Link Archer C64 chiamato TPOS nel messaggio di debug. Consente a qualsiasi utente non privilegiato connesso al router di aggirare il limite di tentativi...
goop
goop Google-Suche-Scraper Hinweis: Es funktioniert nicht mehr. Google hat mir mitgeteilt, dass es kein legitimes Problem sei, als ich es meldete, aber jetzt haben sie es stillschweigend behoben. Inhalt Einleitung Wie funktioniert es? Verwendung Installation Beispiel Rechtliches & Haftungsausschlu...
CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
EUVD-2026-63423
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
EUVD-2026-62850
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...
CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...