wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit This is a Python3 program that exploits Really Simple Security 9.1.2 authentication bypass vulnerability CVE-2024-10924. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool...

Aegis

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

warpgate

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2024-10924

POC for CVE-2024-10924 An error handling flaw in the REST API of the Really Simple Plugins WordPress plugin versions between 9.0.0 and 9.1.1.1 included allows an attacker, when Two-Factor Authentication is enabled, to bypass authentication and take control of an existing user or administrator...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

CVE-2024-10924

Exploit for CVE-2024-10924 WordPress Really Simple Security Plugin - Authentication Bypass 📌 Overview CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security plugin for WordPress versions 9.0.0 to 9.1.1.1. This vulnerability allows unauthenticated attackers ...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

ReelPhish

Instructions for ReelPhish: This tool has been released along with a FireEye blog post. The blog post can be found at the following link: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html Installation Steps 1. The latest release of Python 2.7.x...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Bypass MFA WordPress - Exploit Lab This repository provides a lab for exploiting the CVE-2024-10924 vulnerability in WordPress, specifically to bypass two-factor authentication MFA and gain access to the WordPress administration panel. Prerequisites To deploy this lab in your...

hotpot

Hotpot 🍲 Authy / Google Authenticator for the command line. Hotpot is a simple and secure command-line tool for managing TOTP-based two-factor authentication codes. Hotpot securely stores your 2FA secrets in your system's keyring and generates time-based one-time passwords when you need them. Bui...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

Really Simple Security < 9.1.2 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Multisite 9.0.0 – 9.1.1.1 – Authentication Bypass Description The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610

Xen Orchestra versions prior to 6.9.0 are vulnerable to an authorization bypass within the xo-server user.set API method. This flaw allows low-privileged authenticated users to modify the preferences of other users by providing an arbitrary target user ID. Consequences include the ability to dele...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

EUVD-2026-105088

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...