xmlrpc-brute

Herramienta de Fuerza Bruta XML-RPC para WordPress Una herramienta diseñada para probar sitios WordPress en busca de vulnerabilidades XML-RPC mediante intentos de fuerza bruta de credenciales de usuario a través de la interfaz XML-RPC. Descripción Esta herramienta prueba instalaciones de WordPres...

batchql

BatchQL BatchQL 是一个专注于执行批量 GraphQL 查询和变更的 GraphQL 安全审计脚本。该脚本并不复杂，我们欢迎改进。 在探索 GraphQL 批量攻击的问题空间时，我们发现互联网上有一些博客文章，但缺乏用于执行 GraphQL 批量攻击的工具。 根据所实现的功能，GraphQL 批量攻击可能相当严重。例如，假设有一个密码重置功能，需要输入发送到您邮箱的 4 位数 PIN。使用此工具，您可以在单个 GraphQL 查询中尝试所有 10,000 个 PIN 尝试。根据密码重置流程的实现细节，这可能会绕过任何速率限制或帐户锁定。 检测 该工具能够检测以下内容：...

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descripción : Omisión del límite de peticiones que conduce a la omisión de 2FA Versión probada : 2.7.0 Tipo de ataque: Remoto Impacto : Omisión de 2FA Proveedor del producto : https://www.discourse.org Información adicional : Discourse es una plataforma de...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticação do Kaiten Kaiten - um sistema de gerenciamento de workflow. Uma vulnerabilidade no Kaiten permite que atacantes burlem o mecanismo de autenticação por código PIN. O aplicativo exige que os usuários insiram um código PIN de 6 dígitos enviado para seu e-mail...

CVE-2016-16113-POC

Ottieni RCE - Exploit Bludit CMS root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| Uno strumento di sfruttamento automatizzato che combina CVE-2019-17240 Bypass dell'autenticazione e CVE-2019-16113 Caricamento arbitrario di file...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass del Rate Limit tramite Alias nel Batching GraphQL Codice del programma Node.js + Exploit Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchem...

CVE-2014-0195

Script di Brute-Force per XML-RPC WordPress Questo repository contiene una proof of concept PoC basata su Python per il brute-forcing delle credenziali di accesso su istanze WordPress vulnerabili a CVE-2014-0195, in cui la funzione XML-RPC system.multicall può essere sfruttata per tentare più...

cve-2026-8697

CVE-2026-8697: Bypass del limite di tentativi di accesso su TP-Link Archer C64 CVE-2026-8697 è un difetto logico nel sistema operativo del TP-Link Archer C64 chiamato TPOS nel messaggio di debug. Consente a qualsiasi utente non privilegiato connesso al router di aggirare il limite di tentativi...

goop

goop Google-Suche-Scraper Hinweis: Es funktioniert nicht mehr. Google hat mir mitgeteilt, dass es kein legitimes Problem sei, als ich es meldete, aber jetzt haben sie es stillschweigend behoben. Inhalt Einleitung Wie funktioniert es? Verwendung Installation Beispiel Rechtliches & Haftungsausschlu...

CVE-2024-25277

CVE-2024-25277 scoperto su MW45APT02.0002 Risorse e PoC Questo repository funge da raccolta di script e PoC raccolti durante l'analisi e la scoperta di CVE-2024-25277. Puoi leggere ulteriori informazioni sulla scoperta su:...

requests-ip-rotator

Orgogliosamente sponsorizzato da Swiftproxy Proxy residenziali ad alte prestazioni con un pool di oltre 80 milioni di IP in più di 195 paesi — migliora il tasso di successo delle richieste e riduce i blocchi IP durante la raccolta di dati su larga scala e l'automazione del browser. Perfetto per...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738

Lemmy , a fediverse link aggregator and forum, is vulnerable to rate limit bypass via X-Forwarded-For header spoofing in versions prior to 0.19.19 and 1.0.0-beta.1 . The root cause is that actix-web's ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client addres...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...