inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

CVE-2026-104764

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.17.1 . The root cause is the deserialization of untrusted input via the page_data[meta] parameter. This vulnerability affects authenticated attackers with administrator-l...

EUVD-2026-100912

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object...

CVE-2019-16097

CVE-2019-16097 This program is only for security research, do not use it illegally! Vulnerability Impact Attackers can create an administrator account, upload malicious images, and infect clients using the repository. Affected Component Harbor Affected Versions 1.7.0-1.8.2 Remediation Upgrade to...

impersonate-rs

IRS Impersonate-RS 💡 IRS is a library version of https://github.com/zblurx/impersonate-rs, zblurx Reimplementation of Defte Impersonate in plain Rust. For more informations about it, see this blogpost. The token impersonation approach is a bit different from Defte Impersonate : here you have to...

AddUser-SAMR

AddUser-SAMR Create local administrators using the SAMR API, operating at a lower level than net.exe, PowerShell's New-LocalUser or NetUserAdd API. It requires Administrator privileges and if the user exists, it gets added to the group but the password is not updated. There are 4 implementations ...

simplewall

simplewall Definitely for advanced users. Description: Simple tool to configure Windows Filtering Platform WFP which can configure network activity on your computer. The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems. You can...

CVE-2026-86607

The Hitachi Ops Center Administrator software (versions before 11.0.9-01 ) contains an Internal Application Information Exposure Vulnerability . The root cause involves the generation of error messages containing sensitive information (CWE-209). This vulnerability allows for a low impact on confi...

EUVD-2026-100772

Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0.9-01...

CVE-2026-104767

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 20260828 . The root cause is that the maybe_add_role_to_user() function unconditionally re-assigns roles from the dfxwcrc_foreign_roles u...

EUVD-2026-100767

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

cve-2023-22515-1

🛡️ CVE-2023-22515: In-Depth Analysis of Confluence Privilege Escalation Vulnerability !IMPORTANT Urgent Security Alert : This vulnerability has a CVSS score of 10.0 Critical , the highest risk level. If you are using an affected version, immediate patching is required. 1. Overview CVE-2023-22515...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

PT-2026-113603

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-50215

The Akamai Guardicore Platform Agent (GPA) shipped before version 7.4 contains a use-after-free vulnerability in the Windows WFP packet-capture driver. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can trigger this flaw at DISPATCH_LEVEL by sending a s...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

CVE-2023-30459

CVE-2023-30459 SmartPTT SCADA 1.1.0.0 allows remote code execution when the attacker has administrator privileges by writing a malicious C script and executing it on the server via server settings in the administrator control panel on port 8101, by default. How to use: python CVE-2023-30459.py -t...

monitorr-exploit-toolkit

Monitorr exploit toolkit RCE via unsecure file upload PHP reverse shell, webshell, etc. Administrator account creation via Authorization bypass Technical information leakage : Monitorr version, PHP version, System version & kernel, PHP config, etc. Exploit for CVE-2020-28872 and CVE-2020-28871...

CVE-2026-9218

Certain NETGEAR routers are vulnerable to an insufficient input validation vulnerability within the time server (NTP) setting . An attacker who is connected to the router's local network and possesses administrator credentials can exploit this flaw to execute unauthorized commands on the device. ...