Aegis

Aegis Authenticator Aegis Authenticator es una aplicación 2FA gratuita, segura y de código abierto para Android. Su objetivo es proporcionar un autenticador seguro para tus servicios en línea, al mismo tiempo que incluye algunas funcionalidades que faltan en las aplicaciones de autenticación...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

desktop-2fa

🛡️ Desktop-2FA Un gestor seguro y offline de autenticación de dos factores 2FA para entornos de escritorio. Construido con Python, con cifrado robusto y sin dependencias en la nube. 🌐 Página de inicio : desktop-2fa.org ✨ Características Característica| Descripción ---|--- 🔐 Seguridad del almacén|...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

EUVD-2026-90676

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283

Ghost versions 6.20.0 before 6.57.1 are affected by a session handling vulnerability. This flaw allows authenticated staff users to log in as any other staff member by providing only a password, effectively bypassing two-factor authentication . Attackers with valid staff credentials can exploit t...

CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

EUVD-2026-90550

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

Bypass de 2FA mediante un ataque de fuerza bruta Resumen La aplicación Nagios Fusion versiones 2024R1.2 y 2024R2 es vulnerable a un ataque de fuerza bruta sobre su mecanismo de autenticación de dos factores 2FA. En concreto, la implementación de 2FA no aplica adecuadamente límites de tasa ni...

Linux Distros Unpatched Vulnerability : CVE-2026-53628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth,...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application Esta es una aplicación vulnerable para probar el exploit de la omisión de autenticación de Really Simple Security 9.1.2 CVE-2024-10924. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Úsala bajo tu...

CVE-2024-10924

CVE-2024-10924 漏洞利用 WordPress Really Simple Security 插件 - 身份验证绕过 📌 概述 CVE-2024-10924 是一个关键的身份验证绕过漏洞，存在于 WordPress 的 Really Simple Security 插件中（版本 9.0.0 到 9.1.1.1）。该漏洞允许未经身份验证的攻击者通过利用双因素认证（2FA）API 中的缺陷，以任何用户（包括管理员）身份登录。 CVE 编号: CVE-2024-10924 严重程度: 🔥 严重 CVSS 9.8 受影响版本: Really Simple Security 9.0.0...

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit Este es un programa en Python3 que explota la vulnerabilidad de omisión de autenticación en Really Simple Security 9.1.2 CVE-2024-10924. DESCARGO DE RESPONSABILIDAD Esta herramienta está destinada a ingenieros de seguridad y personal de appsec...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro y Pro Multisite 9.0.0 - 9.1.1.1 - Bypass de autenticación 📖 Descripción Este script explota una vulnerabilidad en el plugin Really Simple Security versiones 9.0.0 - 9.1.1.1 para WordPress. El fallo permite un bypass de autenticación debido a...

CVE-2026-100712

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100667

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...