Lucene search
+L

280 matches found

Kitploit
Kitploit
added 2026/09/06 2:43 p.m.3 views

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. الوصف: تجاوز حد المعدل الذي يؤدي إلى تجاوز المصادقة الثنائية الإصدار المختبر: 2.7.0 نوع الهجوم: عن بُعد الأثر: تجاوز المصادقة الثنائية بائع المنتج: https://www.discourse.org معلومات إضافية: Discourse هي منصة نقاش بُنيَت للعقد القادم من الإنترنت. تُستخدم كـ:...

7.5CVSS7.4AI score0.03073EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/06 12:34 p.m.4 views

requests-ip-rotator

Proudly sponsored by Swiftproxy High-performance residential proxies with an 80M+ IP pool across 195+ countries — improve request success rates and reduce IP blocks during large-scale data collection and browser automation. Perfect for use with requests-ip-rotator, Playwright, Selenium, and other...

5.8AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/06 12:20 p.m.4 views

xmlrpc-brute

WordPress XML-RPC Bruteforce Tool A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface. Description This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standar...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/06 2:10 a.m.6 views

CVE-2024-41276

CVE-2024-41276 Kaiten Authentication Bypass Kaiten - a workflow management system. A vulnerability in Kaiten allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their logi...

9.8CVSS5.9AI score0.01073EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/05 7:29 p.m.7 views

batchql

BatchQL BatchQL — это скрипт для аудита безопасности GraphQL, ориентированный на выполнение пакетных запросов и мутаций GraphQL. Скрипт не сложен, и мы приветствуем улучшения. При исследовании области атак с помощью пакетной обработки GraphQL мы обнаружили, что в интернете есть несколько публикац...

6AI score
SaveExploits0
OSV
OSV
added 2026/09/05 12:09 p.m.2 views

CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

6.3CVSS5.8AI score
SaveExploits0References4
CVE
CVE
added 2026/09/05 12:09 p.m.11 views

CVE-2026-86186

AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...

6.5CVSS5.8AI score
SaveExploits0References2
EUVD
EUVD
added 2026/09/05 12:09 p.m.5 views

EUVD-2026-72007

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

6.5CVSS5.8AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/04 12:03 p.m.6 views

cve-2026-8697

CVE-2026-8697: TP-Link Archer C64 पर लॉगिन दर सीमा बाईपास CVE-2026-8697, TP-Link Archer C64 के OS डिबग संदेश में TPOS कहा गया में एक तर्क दोष है। यह राउटर से जुड़े किसी भी अविशेषाधिकार प्राप्त उपयोगकर्ता को अवशिष्ट SSH सेवा का उपयोग करके वेब UI दर सीमा को बायपास करने देता है। एक सरल Python...

8.8CVSS7.8AI score0.0051EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/04 7:16 a.m.5 views

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – تجاوز حد المعدل عبر الأسماء المستعارة لتجميع GraphQL كود البرنامج استغلال Node.js + Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema =...

7.8CVSS5.9AI score0.0008EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/04 4:43 a.m.6 views

goop

goop Google खोज स्क्रैपर नोट: यह अब काम नहीं करता। जब मैंने Google टीम को इसकी सूचना दी तो उन्होंने बताया कि यह कोई वैध समस्या नहीं है, लेकिन अब उन्होंने चुपचाप इसे ठीक कर दिया है। सामग्री परिचय यह कैसे काम करता है? उपयोग स्थापना उदाहरण कानूनी और अस्वीकरण परिचय goop CAPTCHA द्वारा अवरुद्ध हुए बिन...

6AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/02 11:53 a.m.5 views

CVE-2014-0195

Script d'exploitation par force brute XML-RPC WordPress Ce dépôt contient une preuve de concept PoC basée sur Python pour effectuer une attaque par force brute sur les identifiants de connexion des instances WordPress vulnérables à CVE-2014-0195, où la fonction XML-RPC system.multicall peut être...

6.8CVSS7.1AI score0.99977EPSS
SaveExploits4
OSV
OSV
added 2026/09/01 10:25 p.m.6 views

CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...

8.7CVSS5.9AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/01 8:10 p.m.6 views

CVE-2016-16113-POC

Get RCE - Bludit CMS शोषण root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| एक स्वचालित शोषण उपकरण जो CVE-2019-17240 प्रमाणीकरण बायपास और CVE-2019-16113 मनमाना फ़ाइल अपलोड को जोड़कर कमजोर Bludit CMS इंस्टॉलेशन पर रिमोट कोड निष्पादन...

9.8CVSS6.2AI score0.77962EPSS
SaveExploits24References1
Kitploit
Kitploit
added 2026/09/01 2:04 a.m.4 views

CVE-2024-25277

CVE-2024-25277 MW45APT02.0002 पर खोजा गया संसाधन और PoCs यह रिपॉजिटरी CVE-2024-25277 के विश्लेषण और खोज के दौरान एकत्रित स्क्रिप्ट्स और PoCs के संग्रह के रूप में कार्य करता है। आप इस खोज के बारे में अधिक पढ़ सकते हैं:...

5.8AI score
SaveExploits0
EUVD
EUVD
added 2026/08/30 2:33 p.m.15 views

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

8.7CVSS5.9AI score0.00264EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/30 2:33 p.m.15 views

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

6.9CVSS5.9AI score0.00204EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/30 2:33 p.m.33 views

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

6.9CVSS0.00204EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/20 4:16 p.m.28 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS0.00274EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/20 4:16 p.m.15 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.6AI score
SaveExploits0References3
Rows per page
Query Builder