evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

desktop-2fa

🛡️ Desktop-2FA A secure, offline two-factor authentication 2FA manager for desktop environments. Built with Python, featuring strong encryption and no cloud dependencies. 🌐 Landing Page : desktop-2fa.org ✨ Features Feature| Description ---|--- 🔐 Vault Security| AES-256-GCM encryption with Argon2id...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

Aegis

Aegis Authenticator Aegis Authenticator est une application 2FA gratuite, sécurisée et open source pour Android. Il vise à fournir un authentificateur sécurisé pour vos services en ligne, tout en incluant certaines fonctionnalités manquantes dans les applications d'authentification existantes,...

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , is vulnerable to a two-factor authentication bypass. The root cause is the failure to invalidate a time-based one-time passcode (TOTP) after its initial use. An attacker who possesses an account's password and observes a valid code within ...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Обход MFA WordPress - Лаборатория эксплойта Этот репозиторий предоставляет лабораторию для эксплуатации уязвимости CVE-2024-10924 в WordPress, а именно для обхода двухфакторной аутентификации MFA и получения доступа к панели администрирования WordPress. Предварительные требования...

CVE-2026-103283

Ghost versions 6.20.0 before 6.57.1 are affected by a session handling vulnerability. This flaw allows authenticated staff users to log in as any other staff member by providing only a password, effectively bypassing two-factor authentication . Attackers with valid staff credentials can exploit t...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

EUVD-2026-90676

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

EUVD-2026-90550

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

Linux Distros Unpatched Vulnerability : CVE-2026-53628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth,...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...