Another-Metabase-RCE-CVE-2023-38646

Extension of the Pre-Auth RCE in Metabase CVE-2023-38646 explained here This helped me to avoid errors related to "database already in use" with H2 and postgre as engines root@kitploit: "token": "TOKEN", "details": "isondemand": false, "isfullsync": false, "issample": false, "cachettl": null,...

CVE-2017-7921

Hikvision Camera Lister & Snapshot Tool Standalone tool to list Hikvision cameras from a file and take a snapshot from each using valid credentials HTTP Basic or Digest auth or the CVE auth bypass. Intended to run on another host for testing. Features List cameras from a text file one host or...

cve-2026-67363-67364

Balbooa Forms RCE pré-auth + Altération de paiement CVE-2026-67364 / CVE-2026-67363 PoC et modèles de détection pour deux vulnérabilités pré-auth dans Balbooa Forms combaforms pour Joomla, corrigées dans la version 2.4.3.2. CVE-2026-67364 — Injection de code PHP pré-auth - RCE CVSS 9.8...

CVE-2026-39987

CVE-2026-39987 marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability root@kitploit: / | |// / / / / / / |/ |/ \ / | | | \ /| | /| //|/|/ / | | | / -----/ | |/ |/ ----- \ | |/ \ / / / / //// / | |// CVE-2026-39987 Marimo /terminal/ws —...

cve-2026-42945

CVE-2026-42945 — Dépassement de tampon dans la réécriture NGINX : analyse, DoS et port crédité d'une RCE Recherche en sécurité sur CVE-2026-42945 CVSS 4.0 9.2 CRITIQUE : un dépassement de tampon sur le tas dans le moteur de scripts de NGINX où une rewrite avec des arguments dans le remplacement p...

IngressNightterror

IngressNightterror CVE-2025-1974 Overview This repository is my research on IngressNightmare vulnerability. It includes a vulnerable Ingress deploy files, exploit itself and shared object payload. CVE The list of CVE indexes: CVE-2025-1974 - Root vulnerability CVE-2025-24514 - auth-url annotation...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass Korean: README.ko.md Apache advisory: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl published 2026-07-29 CVE record: https://vulners.com/cve/CVE-2026-59243 Fixed in: apache-airflow-providers-fab==3.7.3 Class:...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth Bypass Exploit for WordPress Plugin WP Directorybox Manager 🔥 Automated exploit script for CVE-2025-0316 — Auth Bypass via vulnerable AJAX action. ⚠️ Legal Notice This tool is intended strictly for: Research Red Team simulation Authorized...

CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabase Pre-Auth RCE via SQL injection The script will GET /api/session/properties to get the setup token and assess exploitability of the target. If it's vulnerable will then print the setup token, else it will quit after an error message. ...

CVE-2025-64446

POC - CVE-2025-64446 - FortiWeb RCE via Path Traversal + Contournement d'authentification Aperçu Les produits Fortinet font partie des appareils les plus éprouvés sur le terrain protégeant les réseaux d'entreprise aujourd'hui — et ironiquement, dès qu'un appareil Forti devient vulnérable, le rayo...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...

CVE-2025-29927_Next.js_Auth_Bypass

CVE-2025-29927 - Next.js Auth Bypass PoC This is a Proof of Concept PoC in Python to detect the critical vulnerability CVE-2025-29927 that affects applications developed with Next.js , specifically when they use middleware for authorization. 📌 The vulnerability allows completely bypassing...

CVE-2026-90495

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2021-3560

Polkit D-Bus Authentication Bypass Exploit A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a method over D-Bus and kills the client proces...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 Account Pre-Hijacking A PocketBase auth collection with OAuth2 enabled lets the client pass a createData object when it signs up. The email inside createData is never checked against the email the OAuth2 provider verified. Anyone with an account on a configured...

CVE-2026-90495

Fengoffice Feng Office versions up to 3.11.13.11 contain a SQL injection vulnerability in the Legacy API component, specifically in the function Contacts::instance->findAll within the file application/models/CompanyWebsite.class.php. Manipulation of the auth argument allows a remote, unauthent...

EUVD-2026-76942

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2021-26084

CVE-2021-26084 Proof of concept for CVE-2021-26084. Confluence Server Webwork OGNL injection Pre-Auth RCE Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. Command Limiations Due to the payload, it is not possible to pass some...

CVE-2026-32202

Authentification forcée sans clic : la consultation d'un dossier contenant le fichier .lnk conçu déclenche la résolution UNC lors du rendu de l'icône, contraignant la victime à établir une connexion sortante vers un serveur contrôlé par l'attaquant, ce qui divulgue et permet le relais de ses...