CVE-2023-32784-keepass-linux

KeePass 2.53/cmdline files and store the pid of ones with the keyword KeePass in their commandline argument. It'll then acquire the adresses of memory maps in /proc//maps that aren't directly associated with a library, meaning they have an empty file path. It'll then store the memory of all those...

CVE-2023-7028

CVE-2023-7028: CVE-2023-7028 Exploitation Tool Description: This Python script automates the exploitation of a hypothetical security vulnerability CVE-2023-7028 on GitLab instances. It facilitates password reset attacks on specified target email addresses, demonstrating a potential security risk...

CVE-2025-50433

CVE-2025-50433 — Critical Account Takeover Vulnerability Affecting Monnit Cloud Platforms .imonnit.com Summary A critical authentication vulnerability exists across .imonnit.com that allows full Account Takeover ATO on any user account without victim interaction. The backend fails to validate the...

CVE-2026-108677 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-108677

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-72898

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection Metabase Pre-Authentication SQL Injection Leading to Admin Takeover Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the...

CVE-2019-9053

CMS Made Simple Extracts data character by character by checking response delays. Extracts: Salt cmssiteprefs table Admin username cmsusers Admin email cmsusers Admin password hash cmsu...

CVE-2025-67070-Intelbras-CFTV-MFA-Bypass

Intelbras NVD 9032 R Ftd – Vulnerabilidad crítica de restablecimiento de contraseña Descubierto por: Theo Cia CVE: CVE-2025-67070 Estado: Reportado al proveedor Fecha de descubrimiento: Noviembre 2025 Impacto: Acceso administrativo completo mediante bypás de MFA Firmware: V2.800.00IB00C.0.T Build...

CVE-2024-13513.py

Usage Basic Usage bash python3 exploit.py -l targets.txt -e [email protected] Advanced Usage bash python3 exploit.py -l targets.txt -e [email protected] -t 100 -o /path/to/results Parameters Explanation Parameter Description Required Default -l, --list Path to file containing target URL...

CVE-2020-7378

CVE-2020-7378 – OpenCRX Predictable Password Reset Token and XXE Exploit This repository contains a combined proof-of-concept PoC exploit for CVE-2020-7378 , a critical vulnerability in OpenCRX versions up to and including 5.0-20200717. The exploit chains two core issues in the application: 1. A...

CVE-2024-56429

CVE-2024-56429 Access to the local database of the iLabClient Extract database password The iLabClient uses an Apache Derby database to store the locally required data. To ensure the encryption, a bootPassword is used for the creation, which can be extracted from the source code the extracted cod...

Digisol-DG--GR1321-s-Password-Storage-in-Plaintext--CVE-2024-4232

Digisol-DG--GR1321-s-Password-Storage-in-Plaintext--CVE-2024-4232...

CVE-2019-19609-POC-Python

The script will try to reset the password to the one declared in the "updatedpass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7 Description A vulnerability in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. Impact Weak Passwords Accepted: Attackers can guess simple passwords or use...

CVE-2026-108580

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verifyuser response timing and...

CVE-2021-22911

CVE-2021-22911 If you have already registered a user this will only reset the admin password, and not both. Making the exploit run much faster. python3 exploit.py -u test -a [email protected] -t http://chat.rocket.thm -i 10.10.4.24 -p 80...

EUVD-2026-96363

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verifyuser response timing and...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001

CVE-2025-52691 / WT-2026-0001 SmarterMail Exploit 🚨 IMPORTANT NOTICE This tool is for authorized security testing and educational purposes only! Unauthorized use is illegal and unethical Only use on systems with explicit authorization Use at your own risk Users are responsible for compliance with...

CVE-2024-34327

CVE-2024-34327 SQL Injection Vulnerability Checker This script V-24-02-001SQLiCheck.py is a proof-of-concept PoC tool to verify the presence of a time-based blind SQL injection vulnerability affecting the password-reset-token.php endpoint, identified as CVE-2024-34327. ⚠️ Disclaimer This tool is...