FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

MStore API <= 3.9.1 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated...

OpenBullet2 <= 0.3.2 - Authentication Bypass

OpenBullet2 = 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header. id: CVE-2026-25555 info: name: OpenBullet2 = 0.3.2 -...

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users. id: CVE-2026-44825 inf...

AffiliateImporterEb <= 1.0.6 - Reflected XSS

AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

CVE-2020-24597

HK 제작 CVE-2020-24597: commedia의 디렉터리 트래버설을 통한 RCE 참고: Joomla core 3.9.21이 잘못 수정되었기 때문에 이 버그는 제대로 패치되지 않았습니다. 저는 이 패치를 쉽게 우회할 수 있습니다. 이 버그가 완전히 패치될 때까지 이 내용을 비밀로 유지하고 싶습니다. 링크 https://developer.joomla.org/security-centre/827-20200803-core-directory-traversal-in-com-media.html PoC 전체 영향을 받는 버전:...

cve-2025-24472-fortinet_authbypass_reproduction

CVE-2025-24472 — Fortinet FortiOS / FortiProxy 認証バイパス 概要 CVE-2025-24472 は、Fortinet FortiOS および FortiProxy における認証バイパスの脆弱性です。認証されていない攻撃者は、特別に細工された CSF Central Security Fabric プロキシリクエストを作成し、影響を受けるデバイス上でスーパー管理者権限を取得できます。この欠陥の CVSS スコアは 8.1 で、SuperBlack Mora001 を含むランサムウェアグループによって活発に悪用されていることが知られています。...

CVE-2020-24033

fs.com S3900 24T4S 최신 버전1.7.1 및 이전 모든 버전, CSRF 백스테이지 관리자 해당 폼에는 인증 또는 토큰 인증 메커니즘이 없으므로, 전체 액세스 권한을 가진 사용자를 추가할 수 있는 사이트 간 요청 위조사용자 계정 추가가 존재합니다. S3900 24T4S의 모든 폼은 사이트 간 요청 위조 공격에 취약합니다. root@kitploit: User Name admin guest admin2 Access Level 0 option v...

open-sammy

SAMMY オープンソース v2 このリポジトリは、SAMMY（OWASP SAMM ツール）のオープンソース版をホストしています。 https://owasp.org/www-project-open-sammy/ ライセンス このプロジェクトは、クリエイティブ・コモンズ 表示-継承 4.0 国際ライセンスの下でライセンスされています。詳細は LICENSE ファイルを参照してください。 SAMMY v2 セットアップには、データベースにあらかじめ定義されたユーザーが含まれています: ユーザー名: [email protected] パスワード: admin MFA キー:...

CVE-2024-28000

CVE-2024-28000 PoC 이 저장소는 LiteSpeed Cache 플러그인을 사용하는 WordPress 사이트에 영향을 미치는 CVE-2024-28000 취약점을 악용하기 위한 도구를 포함합니다. 포함된 스크립트는 노출된 debug.log 파일의 탐지와 권한 상승 취약점 악용을 자동화하여, 권한 없는 사용자가 관리자 수준의 접근 권한을 획득할 수 있도록 합니다. 이 취약점에 대한 자세한 문서는 다음 링크에서 확인할 수 있습니다:...

CVE-2024-10924-PoC

PoC 인증 우회 MFA Really Simple Security WordPress 플러그인 | CVE-2024-10924 WordPress 웹페이지에 접속하면 취약한 플러그인을 통해 MFA가 활성화되어 있는 것을 볼 수 있습니다: PoC를 실행하고 접속 데이터를 제공해야 합니다: 자동으로 관리자 패널 내 임시 .html 파일을 통해 브라우저가 열립니다. 이 시나리오를 재현할 수 있는 취약한 환경을 자동으로 배포하려면 다음 저장소를 사용할 수 있습니다:...

Monitorizer

Monitorizer 최고의 서브도메인 모니터링 프레임워크 설치 ❗ 면책 조항 --- 관리자 사용자는 로컬 서버에서 코드를 실행할 수 있습니다. 기본 비밀번호를 반드시 변경하십시오. 변경하지 않으면 본인의 책임 하에 사용하시기 바랍니다. Docker 사용하기 root@kitploit: $ curl https://raw.githubusercontent.com/BitTheByte/Monitorizer/main/docker-compose.yml | docker compose -f - up 기본 자격 증명: 모든 준비가 완료되면...