CVE-2026-24061

CVE-2026-24061-PoC ⚠ 이 도구는 교육 목적으로만 제작되었습니다. 통제된 환경 밖에서의 무단 사용은 엄격히 금지됩니다. CVE-2026-24061은 GNU Inetutils의 telnetd버전 1.9.3–2.7에 존재하는 치명적인 취약점CVSS 9.8으로, 원격 공격자가 USER 환경 변수를 통해 -f root를 전달하여 인증을 우회하고 루트 액세스 권한을 얻을 수 있습니다. 이 도구는 이 취약점의 악용을 시뮬레이션하기 위해 제작되었습니다. 요구 사항 Windows OS/Linux Python 3.4+ 사용 방법...

CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

CVE-2019-14530

CVE-2019-14530 Path traversal и DoS уязвимость в проекте OpenEMR Уязвимая функция в файле: /openemr/custom/ajaxdownload.php Условия: 1. любой авторизованный пользователь 2. для случая DoS: директория "/sites/default/documents/cqmqrda/" должна существовать на сервере Из-за логики функции "unlink"...

CVE-2023-23397

CVE-2023-23397 Доказательство концепции Это эксплойт доказательства концепции PoC для CVE-2023-23397, уязвимости в клиенте Windows Microsoft Outlook. Предварительные требования Python 3 пакет pywin32 Как использовать Windows 1. Установите необходимый пакет pywin32, выполнив pip install pywin32. 2...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603 CSRF-уязвимость: приводит к созданию фальшивых клиентов Название проекта и URL репозитория:https://phpgurukul.com/client-management-system-using-php-mysql/ Название уязвимости: Межсайтовая подделка запроса CSRF Затронутая версия: V1.2 Введение Уязвимость межсайтовой подделки запрос...

CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94810

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-12260

The NetBoard CRM demo platform is vulnerable to a SQL injection flaw in the ‘user-name’ POST parameter of the ‘/module/auth/recovery.php’ endpoint. The vulnerability allows for blind attacks using Boolean, error, time-based, and UNION techniques. Successful exploitation enables an attacker to ext...

CVE-2026-12260 SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2021-34621

CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Неаутентифицированное повышение привилегий Описание Функциональность регистрации пользователей плагина позволяла передавать произвольные метаданные пользователя, включая wpcapabilities, во время регистрации, что позволяло пользователям регистрироваться в...

EUVD-2026-94798

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...

EUVD-2026-94792

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85488

Brocade ASCG versions prior to 3.5.0 are susceptible to a hardcoded credential exposure. A well-known Brocade default password is embedded within a script distributed to every customer. A local authenticated user with read access to the installation path can discover these credentials. If default...

fortigate-cve-2022-40684-tool

설명 이 도구는 노출된 CMDB API 엔드포인트를 호출하여 FortiGate 장치의 CVE-2022-40684 노출 여부를 식별하고 검증할 수 있도록 보안 전문가를 지원합니다. 관리 사용자 및 사용자 그룹 열거와 통제된 환경에서의 분석을 위한 선택적 구성 추출을 지원합니다. 기능 취약점 탐지 관리 사용자 열거 로컬 사용자 및 그룹 열거 선별적 구성 덤프 실험실용 안전 테스트 유틸리티 취약점 세부 정보 CVE: CVE-2022-40684 유형: 인증 우회 영향 제품: FortiGate / FortiOS 영향: 관리 API...

CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...