CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...

Suborner

Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...

CVE-2025-0282

PoC for CVE-2025-0282 Remote Unauthenticated Stack Buffer Overflow in Ivanti Products Overview This proof-of-concept demonstrates exploitation of CVE-2025-0282, a critical vulnerability affecting: Ivanti Connect Secure Ivanti Policy Secure Ivanti Neurons for ZTA gateways Based on watchTowr's...

CVE-2023-22518

CVE-2023-22518 Checker for CVE-2023-22518 and CVE-2023-22515 critical vulnerabilities in Confluence. Description This script is designed to check for and exploit vulnerabilities in Atlassian Confluence instances. It checks for the vulnerability CVE-2023-22518, and exploits the vulnerability...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2024-7313

Shield Security Plugin Vulnerability Exploit CVE-2024-7313 Overview This repository contains a Python PoC script designed to exploit a reflected XSS vulnerability in the Shield Security Plugin for WordPress, affecting versions below 20.0.6. The vulnerability CVE-2024-7313 allows an attacker to...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2022-0441

CVE-2022-0441 Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Date: 16.02.2022 Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 Installation git clone...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

CVE-2025-64446 익스플로잇 도구 FortiWeb 기기에서 CVE-2025-64446 취약점 확인 및 익스플로잇을 위한 도구입니다. 설명 이 도구는 FortiWeb 웹 애플리케이션 방화벽의 경로 탐색path traversal 취약점CVE-2025-64446을 테스트하고 익스플로잇합니다. 취약점 상태를 확인하거나 CGI 엔드포인트를 익스플로잇하여 사용자 계정을 생성/수정하는 데 사용할 수 있습니다. 설치 pip install -r requirements.txt 사용법 취약점 확인 읽기 전용 python3 exploit....

CVE-2026-72898

Metabase SQL 인젝션 RCE Metabase /api/session/resetpassword 엔드포인트의 인증되지 않은 SQL 인젝션입니다. 관리자 계정을 생성하고 데이터베이스 자격 증명을 추출합니다. 영향받는 버전 : v58.0 - v63.3 | 패치됨 : v58.24+, v59.21+, v60.17+, v61.11+, v62.9+, v63.5+ 빠른 시작 pip install flask requests python3 CVE-2026-72898.py http://localhost:5000 --check 취약점 SQL...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2021-38699

CVE-2021-38699 TastyIgniter 3.0.7 は、ユーザーアカウント作成時の name フィールドを介して XSS を許可します。 保存型クロスサイトスクリプティングの脆弱性が TastyIgniter v3.0.7 の複数のページに存在し、任意の JavaScript の実行が可能です。 https://vulners.com/cve/CVE-2021-38699 脆弱性のあるページ: /account, /reservation, /admin/dashboard, /admin/systemlogs 脆弱性のあるペイロード: “ 発見者: Justin Whi...

CVE-2026-32488

CVE-2026-32488 CVE-2026-32488 Nonce değerini değişkene al $NONCE = "c82a4f80ba" curl.exe -s -X POST "http://localhost/wp-admin/admin-ajax.php" -d "action=userregistrationuserformsubmit" -d "urfrontendformnonce=$NONCE" -d "formid=6" -d...

CVE-2025-31161

CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit 📌 Description This Python exploit targets CrushFTP servers vulnerable to CVE-2025-31161. The vulnerability allows unauthenticated user account creation by sending a crafted XML payload to the WebInterface, potentially resulting...

CVE-2023-3460

CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This script perform an exploit for this vulnerability and scan different...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro 익스플로잇 📖 설명 이 저장소에는 CVE-2025-6934 에 대한 PoCProof of Concept 익스플로잇 이 포함되어 있으며, 인증 없이 관리자 계정 생성 을 허용하는 WordPress 플러그인: Opal Estate Pro = 1.7.5의 치명적인 취약점입니다. ⚠️ 면책 조항 : 이 도구는 교육 및 보안 연구 목적 으로만 제공됩니다. 작성자는 오용 또는 이로 인해 발생한 피해에 대해 책임지지 않습니다. 🚀 기능 readme.txt에서 플러그인...

cve-2023-40000

cve-2023-40000 That's a PoC of cve-2023-40000. Wordpress LiteSpeed Cache exploit. The CVE could be applied to all LiteSpeed Cache --------------------+"; echo "+----------------------------------------------------------------------+";...

refreshing-mcp-tool

아직 완성되거나 준비된 상태는 아니지만, 코드를 커밋해 두고 싶었다. 이 도구는 기본적으로 UNIX 도메인 소켓을 통해 동작하는 F5의 데이터베이스 프로토콜인 "mcp"를 구현한다. 즉, 이러한 도구를 사용하려면 먼저 F5 장치에서 셸을 확보해야 한다. 일반적으로 스크립트의 출력을 socat을 사용하여 /var/run/mcp로 전달한 다음, 응답을 mcp-parser.rb에 입력하면 된다. 자세한 내용은 아래를 참고하라. 스크립트에 대한 간단한 요약: mcp-getloot.rb - 사용자와 변수를 덤프하는 메시지를 생성한다...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2023-4278

CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...