CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...

web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install python3 -m pip install -r requirements.txt ⏩ Usage $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /| /|| / / / /...

Blacklist3r

Blacklist3r The goal of this project is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage ...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

HingeSDK

HingeSDK Unofficial Python SDK for the Hinge API. Programmatically interact with Hinge to fetch recommendations, send messages, download media, and automate interactions. Authentication & Environment Setup To use this SDK, you need valid authentication credentials. You can store these in a .env...

CVE-2021-3560-Authentication-Agent

PolicyKit CVE-2021-3560 Exploit Authentication Agent Technology Details Blog posts about this exploit : https://ricterz.me/posts/2022-04-28-a-new-exploit-method-for-cve-2021-3560-polkit-linux-privilege-escalation.txt...

CVE-2026-111388 Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

EUVD-2026-102569

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

Project-Deep-Focus

Deep Focus A high-performance network reconnaissance tool for discovering and fingerprinting services across IP ranges. Built for security researchers and network administrators. Table of Contents 1. Overview 2. Features 3. Requirements 4. Installation 5. Usage 6. Configuration 7. Understanding...

CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access CVE-2016-10140 Poc -- Batch Verification Script Vulnerability Description ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass...

360WFP_Exploit

360WFPExploit A proof-of-concept PoC demonstrating potential abuse of the 360 Security WFP driver 360netmonx64wfp.sys interface, aimed at verifying the risk that IOCTL interfaces without caller authentication may be misused by third-party programs. This project is intended for security research a...

cve-2022-23131-exp

Zabbix SSO Auth Bypass CVE-2022-23131 usage: zabbixsessionexp.py -h -t TARGET -u USERNAME -p PROXY -f FILES optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET Zabbix Server -u USERNAME, --username USERNAME Zabbix Admin User -p PROXY, --proxy PROXY Proxy for...

CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspace ONE, vIDM, and vRealize Automation 7.6. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

gssapi-abuse

gssapi-abuse gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directo...

munge

MUNGE Uid 'N' Gid Emporium MUNGE MUNGE Uid 'N' Gid Emporium is an authentication service for creating and validating user credentials. It is designed to be highly scalable for use in an HPC cluster environment. It provides a portable API for encoding the user's identity into a tamper-proof...

CVE-2022-46169

CVE-2022-46169 Exploit Exploit to CVE-2022-46169 vulnerability on Cacti 1.2.19 Options -u --url victim's url -f --forwarded X-Forwarded value to bypass the auth -m --mode: check for Checking for Vulnerable Servers, or exploit for Fun exploitation mode :D Usage 1. $ ./cve202246169.py -u...

CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass Critical Authentication Bypass CVSS 9.8 in customer-managed Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3. 📋 Overview CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web...

SubGPT

SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more. Best part? It's free! The following subdomains were found by this tool with these 30 subdomains as input. call-prompts-staging.example.com dclb02-dca1.prod.example.com activedirectory-sjc1.example.c...

cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

CVE-2023-2732

CVE-2023-2732 MStore API = 3.9.2 - Authentication Bypass https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-392-authentication-bypass Description The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including...