Lucene search
+L

275 matches found

Kitploit
Kitploit
added 2026/09/02 5:47 a.m.3 views

requests-ip-rotator

自豪地由 Swiftproxy 赞助 高性能住宅代理,拥有 超过 1.8 亿 IP 池,覆盖 195+ 个国家/地区 —— 在大规模数据采集和浏览器自动化过程中提高请求成功率,减少 IP 被封禁。非常适合与 requests-ip-rotator、Playwright、Selenium 及其他爬虫工具搭配使用。 开始免费试用 → requests-ip-rotator 一个 Python 库,利用 AWS API Gateway 庞大的 IP 池作为代理,为网络爬虫和暴力破解生成几乎无限的 IP 地址。 该库允许用户绕过基于 IP 的网站和服务速率限制。 除非指定,否则...

5.8AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/02 5:09 a.m.5 views

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticación en Kaiten Kaiten - un sistema de gestión de flujos de trabajo. Una vulnerabilidad en Kaiten permite a los atacantes omitir el mecanismo de autenticación por código PIN. La aplicación requiere que los usuarios ingresen un código PIN de 6 dígitos enviado a su...

9.8CVSS6AI score0.01073EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 8:10 p.m.5 views

CVE-2016-16113-POC

Get RCE - Bludit CMS Exploit root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| An automated exploitation tool that combines CVE-2019-17240 Authentication Bypass and CVE-2019-16113 Arbitrary File Upload to achieve remote code...

9.8CVSS6.1AI score0.77962EPSS
SaveExploits24References1
Kitploit
Kitploit
added 2026/09/01 7:06 p.m.5 views

batchql

BatchQL BatchQL 是一个专注于执行批量 GraphQL 查询和变更的 GraphQL 安全审计脚本。该脚本并不复杂,我们欢迎改进。 在探索 GraphQL 批量攻击的问题空间时,我们发现互联网上有一些博客文章,但缺乏用于执行 GraphQL 批量攻击的工具。 根据所实现的功能,GraphQL 批量攻击可能相当严重。例如,假设有一个密码重置功能,需要输入发送到您邮箱的 4 位数 PIN。使用此工具,您可以在单个 GraphQL 查询中尝试所有 10,000 个 PIN 尝试。根据密码重置流程的实现细节,这可能会绕过任何速率限制或帐户锁定。 检测 该工具能够检测以下内容:...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/01 2:04 a.m.3 views

CVE-2024-25277

CVE-2024-25277 descubierto en MW45APT02.0002 Recursos y PoCs Este repositorio sirve como colección de scripts y PoCs recopilados durante el análisis y descubrimiento de CVE-2024-25277. Puedes leer más sobre el hallazgo en:...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 5:28 a.m.3 views

xmlrpc-brute

Herramienta de Fuerza Bruta XML-RPC para WordPress Una herramienta diseñada para probar sitios WordPress en busca de vulnerabilidades XML-RPC mediante intentos de fuerza bruta de credenciales de usuario a través de la interfaz XML-RPC. Descripción Esta herramienta prueba instalaciones de WordPres...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/30 2:43 p.m.3 views

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descripción : Omisión del límite de peticiones que conduce a la omisión de 2FA Versión probada : 2.7.0 Tipo de ataque: Remoto Impacto : Omisión de 2FA Proveedor del producto : https://www.discourse.org Información adicional : Discourse es una plataforma de...

7.5CVSS7.1AI score0.03073EPSS
SaveExploits4
EUVD
EUVD
added 2026/08/30 2:33 p.m.12 views

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

8.7CVSS5.9AI score0.00264EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/30 2:33 p.m.12 views

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

6.9CVSS5.9AI score0.00204EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/28 5:43 p.m.4 views

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass del Rate Limit tramite Alias nel Batching GraphQL Codice del programma Node.js + Exploit Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchem...

7.8CVSS5.9AI score0.0008EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/28 2:27 p.m.5 views

CVE-2014-0195

Script di Brute-Force per XML-RPC WordPress Questo repository contiene una proof of concept PoC basata su Python per il brute-forcing delle credenziali di accesso su istanze WordPress vulnerabili a CVE-2014-0195, in cui la funzione XML-RPC system.multicall può essere sfruttata per tentare più...

6.8CVSS6.9AI score0.99977EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/08/28 12:03 p.m.5 views

cve-2026-8697

CVE-2026-8697: Bypass del limite di tentativi di accesso su TP-Link Archer C64 CVE-2026-8697 è un difetto logico nel sistema operativo del TP-Link Archer C64 chiamato TPOS nel messaggio di debug. Consente a qualsiasi utente non privilegiato connesso al router di aggirare il limite di tentativi...

8.8CVSS7.2AI score0.0051EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/28 4:43 a.m.3 views

goop

goop Google-Suche-Scraper Hinweis: Es funktioniert nicht mehr. Google hat mir mitgeteilt, dass es kein legitimes Problem sei, als ich es meldete, aber jetzt haben sie es stillschweigend behoben. Inhalt Einleitung Wie funktioniert es? Verwendung Installation Beispiel Rechtliches & Haftungsausschlu...

5.9AI score
SaveExploits0References3
OSV
OSV
added 2026/08/20 4:16 p.m.15 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.6AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 4:16 p.m.28 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/20 4:16 p.m.13 views

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.5AI score0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 8:27 p.m.14 views

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/19 8:27 p.m.33 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS0.00428EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/19 8:27 p.m.24 views

CVE-2026-54738

Lemmy , a fediverse link aggregator and forum, is vulnerable to rate limit bypass via X-Forwarded-For header spoofing in versions prior to 0.19.19 and 1.0.0-beta.1 . The root cause is that actix-web's ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client addres...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/19 8:27 p.m.33 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.6AI score
SaveExploits0References10
Rows per page
Query Builder