Lucene search
+L

276 matches found

Kitploit
Kitploit
added 2026/09/02 6:10 p.m.5 views

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/02 5:40 p.m.3 views

requests-ip-rotator

自豪地由 Swiftproxy 赞助 高性能住宅代理,拥有 超过 1.8 亿 IP 池,覆盖 195+ 个国家/地区 —— 在大规模数据采集和浏览器自动化过程中提高请求成功率,减少 IP 被封禁。非常适合与 requests-ip-rotator、Playwright、Selenium 及其他爬虫工具搭配使用。 开始免费试用 → requests-ip-rotator 一个 Python 库,利用 AWS API Gateway 庞大的 IP 池作为代理,为网络爬虫和暴力破解生成几乎无限的 IP 地址。 该库允许用户绕过基于 IP 的网站和服务速率限制。 除非指定,否则...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/02 5:15 p.m.3 views

xmlrpc-brute

Herramienta de Fuerza Bruta XML-RPC para WordPress Una herramienta diseñada para probar sitios WordPress en busca de vulnerabilidades XML-RPC mediante intentos de fuerza bruta de credenciales de usuario a través de la interfaz XML-RPC. Descripción Esta herramienta prueba instalaciones de WordPres...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/02 11:53 a.m.5 views

CVE-2014-0195

Script de Explotación de Fuerza Bruta XML-RPC para WordPress Este repositorio contiene una prueba de concepto PoC basada en Python para realizar ataques de fuerza bruta a credenciales de inicio de sesión en instancias de WordPress vulnerables a CVE-2014-0195, donde la función system.multicall de...

6.8CVSS6.9AI score0.99977EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/02 5:09 a.m.5 views

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticación en Kaiten Kaiten - un sistema de gestión de flujos de trabajo. Una vulnerabilidad en Kaiten permite a los atacantes omitir el mecanismo de autenticación por código PIN. La aplicación requiere que los usuarios ingresen un código PIN de 6 dígitos enviado a su...

9.8CVSS5.9AI score0.01073EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 8:10 p.m.5 views

CVE-2016-16113-POC

Get RCE - Bludit CMS Exploit root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| An automated exploitation tool that combines CVE-2019-17240 Authentication Bypass and CVE-2019-16113 Arbitrary File Upload to achieve remote code...

9.8CVSS6.1AI score0.77962EPSS
SaveExploits24References1
Kitploit
Kitploit
added 2026/09/01 2:04 a.m.3 views

CVE-2024-25277

CVE-2024-25277 descubierto en MW45APT02.0002 Recursos y PoCs Este repositorio sirve como colección de scripts y PoCs recopilados durante el análisis y descubrimiento de CVE-2024-25277. Puedes leer más sobre el hallazgo en:...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/30 2:43 p.m.3 views

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descripción : Omisión del límite de peticiones que conduce a la omisión de 2FA Versión probada : 2.7.0 Tipo de ataque: Remoto Impacto : Omisión de 2FA Proveedor del producto : https://www.discourse.org Información adicional : Discourse es una plataforma de...

7.5CVSS7.1AI score0.03073EPSS
SaveExploits4
EUVD
EUVD
added 2026/08/30 2:33 p.m.12 views

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

8.7CVSS5.9AI score0.00264EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/30 2:33 p.m.12 views

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

6.9CVSS5.9AI score0.00204EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/30 2:33 p.m.32 views

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

6.9CVSS0.00204EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/28 5:43 p.m.4 views

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass del Rate Limit tramite Alias nel Batching GraphQL Codice del programma Node.js + Exploit Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchem...

7.8CVSS5.9AI score0.0008EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/28 12:03 p.m.5 views

cve-2026-8697

CVE-2026-8697: Bypass del limite di tentativi di accesso su TP-Link Archer C64 CVE-2026-8697 è un difetto logico nel sistema operativo del TP-Link Archer C64 chiamato TPOS nel messaggio di debug. Consente a qualsiasi utente non privilegiato connesso al router di aggirare il limite di tentativi...

8.8CVSS7.2AI score0.0051EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/28 4:43 a.m.4 views

goop

goop Google-Suche-Scraper Hinweis: Es funktioniert nicht mehr. Google hat mir mitgeteilt, dass es kein legitimes Problem sei, als ich es meldete, aber jetzt haben sie es stillschweigend behoben. Inhalt Einleitung Wie funktioniert es? Verwendung Installation Beispiel Rechtliches & Haftungsausschlu...

5.9AI score
SaveExploits0References3
OSV
OSV
added 2026/08/20 4:16 p.m.15 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.6AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 4:16 p.m.28 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/20 4:16 p.m.13 views

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.5AI score0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 8:27 p.m.14 views

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/19 8:27 p.m.34 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS0.00428EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/19 8:27 p.m.33 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.6AI score
SaveExploits0References10
Rows per page
Query Builder