CVE-2024-10924

CVE-2024-10924 익스플로잇 WordPress Really Simple Security 플러그인 - 인증 우회 📌 개요 CVE-2024-10924는 WordPress용 Really Simple Security 플러그인버전 9.0.0 9.1.1.1의 치명적인 인증 우회 취약점입니다. 이 취약점을 통해 인증되지 않은 공격자는 Two-Factor Authentication2FA API의 결함을 악용하여 모든 사용자관리자 포함로 로그인할 수 있습니다. CVE ID: CVE-2024-10924 심각도: 🔥 치명적 CVSS 9....

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit Это программа на Python3, которая эксплуатирует уязвимость обхода аутентификации Really Simple Security 9.1.2 CVE-2024-10924. ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Этот инструмент предназначен для инженеров безопасности и специалистов по безопасности...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro, and Pro Multisite 9.0.0 - 9.1.1.1 - 인증 우회 📖 설명 이 스크립트는 WordPress용 Really Simple Security 플러그인버전 9.0.0 - 9.1.1.1의 취약점을 악용합니다. 이 결함은 Two-Factor Authentication API의 checkloginandgetuser 함수에서 부적절한 오류 처리로 인해 인증 우회를 허용합니다. 이 익스플로잇을 사용하면 공격자는 2FA가...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security의 Docker 인증 우회 결함 설명 WordPress용 Really Simple Security 플러그인Free, Pro 및 Pro Multisite 버전 9.0.09.1.1.1은 인증 우회 취약점의 영향을 받습니다. 이 문제는 2단계 인증 REST API 작업에 사용되는 checkloginandgetuser 함수의 부적절한 오류 처리로 인해 발생합니다. 결과적으로, "Two-Factor Authentication"2단계 인증 기능이 활성...

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , is vulnerable to a two-factor authentication bypass. The root cause is the failure to invalidate a time-based one-time passcode (TOTP) after its initial use. An attacker who possesses an account's password and observes a valid code within ...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 MFAバイパス WordPress - エクスプロイトラボ このリポジトリは、WordPress の CVE-2024-10924 脆弱性を悪用して、二要素認証（MFA）をバイパスし、WordPress 管理パネルへのアクセスを取得するためのラボを提供します。 前提条件 このラボを自分の環境に展開するには、以下の手順に従ってください。 VMware に WordPress をデプロイする LAB の zip を解凍し、VMware で Open をクリックしてマシンをインポートします。Ubuntu-Bypass-MFA-Wordpress.vmx...

PT-2026-104520

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 4.1.0 Description The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during it...

CVE-2026-103514: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

ReelPhish

Инструкции для ReelPhish: Этот инструмент был выпущен вместе с публикацией в блоге FireEye. Запись в блоге можно найти по следующей ссылке: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html Этапы установки 1. Требуется последняя версия Python...

hotpot

Hotpot 🍲 커맨드라인용 Authy / Google Authenticator Hotpot은 TOTP 기반 2단계 인증 코드를 관리하기 위한 간단하고 안전한 커맨드라인 도구입니다. Hotpot은 2FA 비밀키를 시스템 키링에 안전하게 저장하고, 필요할 때 시간 기반 일회용 비밀번호를 생성합니다. 보안, 성능, 안정성을 위해 Rust로 제작되었습니다. 기능 시스템 키링Keychain/libsecret/Credential Manager을 사용하는 안전한 저장 사용자 정의 가능한 알고리즘SHA1/SHA256/SHA512을 지원하는...

EUVD-2026-90676

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283

Ghost versions 6.20.0 before 6.57.1 are affected by a session handling vulnerability. This flaw allows authenticated staff users to log in as any other staff member by providing only a password, effectively bypassing two-factor authentication . Attackers with valid staff credentials can exploit t...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103283 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to...

CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

EUVD-2026-90550

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...

CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP contains a vulnerability in its two-factor authentication TOTP verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is verified as a second authentication factor...