CVE-2022-0847

CVE-2022-0847 CVE-2022-0847의 익스플로잇으로, 루트 계정의 비밀번호를 직접 제거합니다. 사용법: 1. gcc cve-2022-0847.c -o exploit 2. ./exploit 요구 사항: gcc 작동 요약: Max Kellermann의 전통적인 클래식 익스플로잇 POC는 루트 권한을 가진 사용자를 추가하는 데 사용되었지만, 이 POC 익스플로잇은 /etc/passwd 파일 root❌0:0:root:/root:/bin/bash을 수정하여 루트 계정의 비밀번호를 제거합니다. 코드 관련 세부 사항: 이에 ...

CVE-2017-13872-Patch

CVE-2017-13872-Патч Загрузите это программное обеспечение и выполните его, после чего оно запросит новый пароль для пользователя root. Пароль может быть другим, но, я думаю, по умолчанию он равен паролю администратора. Обновление Вы можете исправить ошибку, обновив вашу операционную систему...

CVE-2023-28432

CVE-2023-28432MinIO 정보 유출 계정 및 비밀번호 유출 MinIO 시스템에는 정보 유출 취약점이 존재하며, 인증되지 않은 원격 공격자가 특수 POST 요청을 /minio/bootstrap/v1/verify로 전송하여 MINIOSECRETKEY 및 MINIOROOTPASSWORD를 포함한 모든 민감 정보를 획득할 수 있으며, 이로 인해 관리자 계정 및 비밀번호가 유출될 수 있습니다. 사용 방법 xk-mt-CVE-2023-28432.py -u http://127.0.0.1:9001/login 포트와 URL이 자동으로...

CVE-2026-41940

CVE-2026-41940 — WHM/cPanel 인증 우회 연구 도구 이 저장소는 cPanel/WHMwhostmgrsession 쿠키 및 HTTP 헤더를 통한 인증 우회 체인에 기반한 개념 증명PoC 스크립트를 포함합니다. 이 스크립트는 침투 성공 후 root 비밀번호를 변경하고 결과를 파일에 기록합니다. 법적 고지 이 소프트웨어는 명시적 허가를 받은 시스템에서만자체 랩 환경, 계약된 펜테스트, 공급업체 승인 보안 테스트 사용하십시오. 무단 접근은 대부분의 국가에서 범죄 입니다. 이 README는 보안 연구 및 방어 인식...

EUVD-2026-81029

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the getinstance gate...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM 인증 우회 + 루트 비밀번호 변경기 이 스크립트는 CRLF 인젝션 기술을 사용하여 관리자 세션을 위조함으로써 cPanel/WHMCVE-2026-41940의 인증 우회 취약점을 악용합니다. 성공하면 스크립트는 WHM에서 root 사용자의 비밀번호를 변경하고 Telegram을 통해 알림을 보낼 수 있습니다. 경고: 소유한 시스템 또는 서면 허가를 받은 시스템에서만 보안 테스트 용도로 사용하십시오. 이 스크립트를 불법 액세스에 악용하는 것은 법률 위반입니다. 📦 의존성 설치 PIP ...

CVE-2024-25832-PoC

CVE-2024-25830 и CVE-2024-25832 - DataCube3: неправильный контроль доступа и неограниченная загрузка файлов. Обзор Этот репозиторий содержит доказательство концепции PoC для двухэтапной цепочки эксплойтов, нацеленной на устройства DataCube3. Он объединяет CVE-2024-25830 неправильный контроль...

CVE-2026-66408

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...

CVE-2026-66408

CVE-2026-66408 affects the DEEBOT PRO M1 and DEEBOT PRO K1VAC: the root accounts are configured with weak passwords. A user with physical access can obtain the root password, enabling privileged action on the device. The CVSS metrics indicate a physical attack with low complexity, but high confid...

CVE-2026-49005

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005

CVE-2026-49005 affects ZTE F689 devices, where the root password hash can be obtained from unencrypted firmware information. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields a LOW base score (2.4), indicating limited impact to confidentiality. The description confirms leakage of t...

EUVD-2026-54357

The root password hash of the device can be obtained through unencrypted information in the firmware...

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...

CVE-2026-67594

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

PYSEC-2026-2003 vantage6 has insecure SSH configuration for node and server containers

Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...

CVE-2026-55740 SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Nur-Alam39 bus-ticket no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad contains an unauthenticated SQL injection vulnerability in businfo.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query select from businfo where id= without...

CVE-2026-54445 Vantage6: Set admin user and password from environment or configuration

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username root and password root. This is not ideal because attackers know that almost all vantage6 servers have a user with username root that probably has admin rights,...

CVE-2026-40425

The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password...