credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

CVE-2025-70829

CVE-2025-70829: Datart における情報漏洩 中文文档 1. 脆弱性の概要 CVE ID : CVE-2025-70829 製品 : Datart バージョン : v1.0.0-rc.3 脆弱性タイプ : 情報漏洩 Datart v1.0.0-rc.3 における情報漏洩の脆弱性により、認証済みの攻撃者はカスタム H2 JDBC 接続文字列を介して機密データにアクセスできます。アプリケーションを自身の内部データベースファイルに接続させることで、攻撃者はユーザー資格情報や構成詳細を含むシステムテーブルにクエリを実行できます。 2. 再現手順 前提条件 Datart...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

munge

MUNGE Uid 'N' Gid Emporium MUNGE（ MUNGE Uid 'N' Gid Emporium ）是一种用于创建和验证用户凭据的身份验证服务。它被设计为具有高度可扩展性，适用于 HPC 集群环境。它提供了一个可移植的 API，用于将用户身份编码为防篡改的凭据，该凭据可以由不受信任的客户端获取，并由安全域内不受信任的中介转发。该域内的客户端无需使用 root 权限、保留端口或平台特定的方法即可创建和验证凭据。 概述 安装指南 许可证信息 手册页 验证发布...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-19051

Menulux Portal by Menulux Software Inc. is vulnerable to plaintext storage of a password , allowing an authenticated low-privilege attacker to retrieve embedded sensitive data over the network. The vulnerability affects versions prior to 20260903211448 . The CNA-assigned CVSS 3.1 score is 7.1 (Hi...

CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

WSO2-2020-0731

WSO2-2020-0731: vulnerabilidades XXE y XSS en WSO2 Carbon Se han identificado potenciales XXE y XSS en múltiples productos WSO2. Divulgación del proveedor: La divulgación y el parche del proveedor para esta vulnerabilidad se pueden encontrar aquí. ¿Por qué no hay CVE? Ni yo ni el proveedor...

The vulnerability of the pgcrypto module in the PostgreSQL database management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

EUVD-2026-53474

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-15918

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-44105

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

CVE-2026-44105

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

EUVD-2026-51041

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

PT-2026-66433

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

CVE-2026-16496

The CVE concerns terraform-mcp-server prior to version 1.1.0, where an authorization bypass in the streamable-HTTP stateful transport mode could allow a user who obtains another user’s MCP session ID to execute tool calls using that user’s Terraform credentials. Affected component: terraform-mcp-...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...