CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. الوصف: تجاوز حد المعدل الذي يؤدي إلى تجاوز المصادقة الثنائية الإصدار المختبر: 2.7.0 نوع الهجوم: عن بُعد الأثر: تجاوز المصادقة الثنائية بائع المنتج: https://www.discourse.org معلومات إضافية: Discourse هي منصة نقاش بُنيَت للعقد القادم من الإنترنت. تُستخدم كـ:...

requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

xmlrpc-brute

WordPress XML-RPC Bruteforce Tool A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface. Description This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standar...

CVE-2024-41276

CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...

batchql

BatchQL BatchQL — это скрипт для аудита безопасности GraphQL, ориентированный на выполнение пакетных запросов и мутаций GraphQL. Скрипт не сложен, и мы приветствуем улучшения. При исследовании области атак с помощью пакетной обработки GraphQL мы обнаружили, что в интернете есть несколько публикац...

CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-86186

AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...

EUVD-2026-72007

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

cve-2026-8697

CVE-2026-8697: TP-Link Archer C64 पर लॉगिन दर सीमा बाईपास CVE-2026-8697, TP-Link Archer C64 के OS डिबग संदेश में TPOS कहा गया में एक तर्क दोष है। यह राउटर से जुड़े किसी भी अविशेषाधिकार प्राप्त उपयोगकर्ता को अवशिष्ट SSH सेवा का उपयोग करके वेब UI दर सीमा को बायपास करने देता है। एक सरल Python...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – تجاوز حد المعدل عبر الأسماء المستعارة لتجميع GraphQL كود البرنامج استغلال Node.js + Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema =...

goop

goop Google खोज स्क्रैपर नोट: यह अब काम नहीं करता। जब मैंने Google टीम को इसकी सूचना दी तो उन्होंने बताया कि यह कोई वैध समस्या नहीं है, लेकिन अब उन्होंने चुपचाप इसे ठीक कर दिया है। सामग्री परिचय यह कैसे काम करता है? उपयोग स्थापना उदाहरण कानूनी और अस्वीकरण परिचय goop CAPTCHA द्वारा अवरुद्ध हुए बिन...

CVE-2014-0195

Script d'exploitation par force brute XML-RPC WordPress Ce dépôt contient une preuve de concept PoC basée sur Python pour effectuer une attaque par force brute sur les identifiants de connexion des instances WordPress vulnérables à CVE-2014-0195, où la fonction XML-RPC system.multicall peut être...

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

CVE-2016-16113-POC

Get RCE - Bludit CMS शोषण root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| एक स्वचालित शोषण उपकरण जो CVE-2019-17240 प्रमाणीकरण बायपास और CVE-2019-16113 मनमाना फ़ाइल अपलोड को जोड़कर कमजोर Bludit CMS इंस्टॉलेशन पर रिमोट कोड निष्पादन...

CVE-2024-25277

CVE-2024-25277 MW45APT02.0002 पर खोजा गया संसाधन और PoCs यह रिपॉजिटरी CVE-2024-25277 के विश्लेषण और खोज के दौरान एकत्रित स्क्रिप्ट्स और PoCs के संग्रह के रूप में कार्य करता है। आप इस खोज के बारे में अधिक पढ़ सकते हैं:...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...