domi-owned

Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...

CVE-2023-36899

CVE-2023-36899 Reproduction environment and tooling for CVE-2023-36899, a cookieless session authentication bypass in the ASP.NET framework. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 In modern web development, despite cookies being the preferred...

CVE-2026-48939

CVE-2026-48939 — iCagenda Joomla RCE Exploit Pre-Auth Arbitrary File Upload → PHP Code Execution Overview CVE-2026-48939 is a CVSS 10.0 critical vulnerability in the iCagenda events calendar extension for Joomla. The frontend event registration form's file attachment feature enforces access...

api-security-audit-action

GitHub Action: 42Crunch REST API Static Security Testing The REST API Static Security Testing action locates REST API contracts that follow the OpenAPI Specification OAS, formerly known as Swagger and runs thorough security checks on them. Both OAS v2 and v3.0.x are supported, in both JSON and YA...

CVE-2023-27350-POC

CVE-2023-27350-POC Description: This tool is designed to exploit an authentication bypass vulnerability in PaperCut MF/NG versions 8.0 and above, but prior to versions 20.1.7, 21.2.11, or 22.0.9. The vulnerability allows for unauthorized access to the system and can potentially be used for...

CVE-2026-24207

CVE-2026-24207 — NVIDIA Triton SageMaker Auth Bypass to Unauth RCE Unauthenticated attackers can reach the model-management surface of NVIDIA Triton Inference Server on the SageMaker and Vertex AI HTTP ports — bypassing the operator's --http-restricted-api configuration. Combined with the SageMak...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

CVE-2024-4358

Telerik Report Server Authentication Bypass - CVE-2024-4358 Overview In Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. Read...

CVE-2026-24061-PoC-Exploit

CVE-2026-24061 - GNU inetutils-telnetd Authentication Bypass Exploit GNU inetutils-telnetd Edition - CRLF Injection to Authentication Bypass & Instant Root Shell -Overview This exploit leverages CVE-2026-24061 , a critical remote authentication bypass vulnerability in GNU inetutils-telnetd. By...

CVE-2026-8023

CVE-2026-8023 — Zephyr HTTP static-fs path traversal PoC Pre-auth path traversal in Zephyr's HTTP server static-fs handler subsys/net/lib/http when wildcard resource matching CONFIGHTTPSERVERRESOURCEWILDCARD=y is used with HTTPRESOURCETYPESTATICFS. Affects both HTTP/1.1 and HTTP/2. GHSA:...

CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...

CVE-2026-109243

A flaw was found in FreeRDP. When software-based smartcard authentication is used on multi-user systems, FreeRDP writes a temporary copy of the private key to a shared directory without enforcing owner-only file permissions. A local, unprivileged attacker can access this shared directory and read...

CVE-2026-41940

CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...

lgosp-poc

LG On Screen Phone authentication bypass PoC What is LG On Screen Phone? The LG On-Screen Phone application OSP makes it easy to access and control LG’s Android smartphones through a PC. The connection can be established either by using an USB cable or wirelessly through Wi-Fi or Bluetooth. When...

CVE-2021-26084

CVE-2021-26084 Atlassian Confluence Pre-Auth RCE...

patch-CVE-2026-11553

Patch: CVE-2026-11553 Vulnerability Details CVE : CVE-2026-11553 Product : VMware vCenter Description : Authentication bypass Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-04-28 Status| deployed Deployed To| Production Validated By| SecOps Team References NVD CI...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover Exploit Framework & Mass Scanner For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for educational and...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80. Field| Value ---|--- CVE| CVE-2026-44578 GHSA|...

cve-2022-42475-poc

CVE-2022-42475 PoC Fortinet SSL VPN Pre-Authentication Remote Code Execution Description CVE-2022-42475 is a heap-based buffer overflow vulnerability in the FortiOS SSL VPN service that allows unauthenticated attackers to remotely execute arbitrary code RCE via specially crafted HTTP requests...

agentsid-scanner

AgentsID Scanner The Lighthouse of agent security. Scan any MCP server. Get a security report card. Your MCP server exposes tools to AI agents. How secure is it? Most MCP servers ship with no authentication, no per-tool permissions, no input validation, and tool descriptions vulnerable to prompt...