CVE-2019-19633

CVE-2019-19633 Chevereto 1.0.0 至 1.1.4 Free 版及 3.13.5 Core 版中的 lib/G/functions.php 允许攻击者通过操纵请求中的 X-Forwarded-For 标头来执行暴力破解攻击，而不会触发已实现的保护机制。该标头中的 IP 必须每 25 次请求（默认 25 次）更改一次，以避免激活保护并封禁 IP（不过这并不重要）。 前 25 次请求 X-Forwarded-For: 8.8.8.1, 8.8.8.2 第二波 25 次请求 X-Forwarded-For: 8.8.8.2, 8.8.8.3 依此类推...

subbrute

子域名暴力破解器 SubBrute SubBrute 是一个社区驱动的项目，旨在创建最快、最准确的子域名枚举工具。SubBrute 的魔力在于它使用开放解析器作为代理来规避 DNS 速率限制（https://www.us-cert.gov/ncas/alerts/TA13-088A）。这种设计还提供了一层匿名性，因为 SubBrute 不会直接将流量发送到目标名称服务器。 v2.1 新特性？ 更好的稳定性。更好地支持测试 Cloudflare 域名。 感谢提交的错误报告！ v1.2.1 新特性？ 此版本的一个重要变化是 SubBrute 现在是一个递归 DNS...

cve-2019-17240

Bludit = 3.9.22 - 暴力破解缓解绕过 这是一个小项目，我将这个Python脚本重写为Go语言。该项目的目的是学习Go语言并理解这个漏洞利用的工作原理。 用法 root@kitploit: $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of ./brutepass: -c int Threads default 5 default 5 -l string Hostname eg... http://127.0.0.1/admin/login.php -p string Password...

EUVD-2026-81053

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed...

CVE_2023_44487-Rapid_Reset

Herramienta de Prueba de Rapid Reset HTTP/2 CVE-2023-44487 - Edición Mejorada Una herramienta integral de pruebas en Python para CVE-2023-44487 , la vulnerabilidad de Rapid Reset en HTTP/2. Esta versión mejorada proporciona control granular sobre los parámetros de prueba, múltiples patrones de...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to the /api/v2 public authentication endpoints (login, register, password-reset, and OAuth token routes). Remote unauthenticated attackers can perform unbounded credential guessing , account enumeration , and password-reset flooding withou...

CVE-2020-35590

Información del exploit Título del exploit: Plugin de WordPress Limit Login Attempts Reloaded 2.13.0 - Bypass del límite de inicio de sesión CVE: CVE-2020-35590 Fecha: 2020-06-09 Autor del exploit: N4nj0 Enlace del software: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Versión:...

CVE-2026-86729 WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

PT-2026-84535

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers. This allows attackers to spoof the client address used by the enforceRateLimit function. By...

CVE-2026-82644

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82644

WWBN AVideo (version e01e41ecc and earlier ) is vulnerable to a brute-force rate-limiting bypass in the enforceRateLimit() function, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal ) that silently discards ...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

PT-2026-83570

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-69183

Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...

PT-2026-79066

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-72815

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

CVE-2026-72816

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

UBUNTU-CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...