CVE-2024-41958-PoC

CVE-2024-41958-PoC Questa è una piccola prova di concetto per CVE-2024-41958. È possibile bypassare l'autenticazione TFA nel pannello di amministrazione. Versioni interessate: 2024-07 Prerequisiti necessari affinché la CVE funzioni: Password e username per un account senza TFA. Password e usernam...

Pwdb-Public

PWDB - Nuova generazione di analisi di massa delle password Obiettivo Lasciando alle spalle la roba di red team vecchia di 20 anni. Le cose funzionano bene e nessuno si preoccupa di controllarle/sostituirle per decenni. Dump inclusi Puoi controllare il file status.txt in questo repository per...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – Falsificazione di firma per debole casualità in SPHINCS+ WOTS+ Panoramica Un'implementazione dello schema di firma post‑quantum SPHINCS+ utilizza un generatore di numeri casuali difettoso durante la generazione delle firme WOTS+. Lo stesso nonce k viene riutilizzato su più firme,...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – Replay dell'autenticazione Digest SIP VoIP Codice del programma simulatore SIP in Python root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – IoT फ़र्मवेयर हस्ताक्षर में ECDSA नॉन्स पुन: उपयोग प्रोग्राम कोड Python root@kitploit: ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware image...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Perdita di credenziali nell'avvio a freddo serverless tramite /tmp riutilizzato Codice del programma simulazione AWS Lambda in Python root@kitploit: lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm start...

CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-

CVE-2026-11117 – Reinstallazione dell'handshake WPA2 a 4 vie Simulazione KRACK Codice del programma Python root@kitploit: kracksim.py - Simulates reinstallation of an already-used PTK import hashlib, os class AccessPoint: def initself: self.anonce = os.urandom32 self.ptk = None def sendmsg3self,...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – Riutilizzo del Nonce AES-GCM che Porta al Recupero della Chiave Codice del Programma Python root@kitploit: aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def...

CVE-2026-81341

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value...

CVE-2026-81020

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-81019

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE

CVE Writeup per CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 root@kitploit: -------------- CVE-2025-67586 Exploit PoC -------------- Titolo Exploit: WordPress Plugin 5.2.0 - Broken Access Control Link del software: https://wordpress.org/plugins/highlight-and-share/ Versione: Descrizione Esiste...

CVE-2026-81341 wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value...

CVE-2026-81341

wolfEngine (before 1.4.1 ) reuses the AES-CCM nonce on TLS 1.2 and DTLS 1.2 records because it sources the explicit nonce from the record input buffer rather than the TLS sequence number. Since the record layer leaves that field for the cipher to populate, the value is constant, meaning every AES...

CVE-2026-81341 wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value...

EUVD-2026-67738

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value...

CVE-2026-81020 wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

EUVD-2026-67737

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

CVE-2026-81020

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce only once when the TLS write key is set and never increments it per record. Consequently, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. GCM nonce reuse discloses...

CVE-2026-81019 wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...