vanda-CVE-2025-3102

Vanda CVE-2025-3102 💣 Exploit with graphical interface for vulnerability CVE-2025-3102 in the WordPress plugin SureTriggers = 1.0.78. 🚀 FEATURES Vulnerability site identification 🕵️‍♂️ Automatic exploitation with admin user creation 👨‍💻 Cyberpunk-style graphical interface 🌌 Results saved in .txt...

CVE-2019-16097

CVE-2019-16097 Harbor Unauthorized Admin Creation Vulnerability Principle docker and poc based on pocsuite framework...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...

CVE-2026-8732-PoC

CVE-2026-8732 — WP Maps Pro Creación de Administrador No Autenticada English | Türkçe English Overview CVE-2026-8732 is a critical vulnerability CVSS 9.8 in the WP Maps Pro wp-google-map-gold WordPress plugin version = 6.1.0. Unauthenticated attackers can create WordPress administrator accounts b...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User How to use This script using Python3. Install requirements pip install -r requirements.txt Reference https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...

CVE-2023-42793

Usage: save it as teamcity-admin-creation.nse and run: nmap -p 8111 --script teamcity-admin-creation --script-args url=https://target-url...

CVE-2019-15896

CVE-2019-15896 LifterLMS = 3.34.5 - Unauthenticated Options Import Description Unauthenticated Options Import, which could lead to Website Redirection Administrator Account Creation Content Injection Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional inp...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2025-13342

CVE-2025-13342 Frontend Admin by DynamiApps - ----/| |/ ----| \ ||/ / / / //// |// |/ ◈ Vulnerability Field| Detail ---|--- CVE ID| CVE-2025-13342 Score| 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Affected| Frontend Admin by DynamiApps ≤ 3.28.20 Auth| None —...

CVE-2023-42791_CVE-2024-23666

Fortimanager insufficient authorization checks CVE-2024-23666 and unrestricted file upload CVE-2023-42791 exploitation scripts Two exploitation scripts leveraging these vulnerabilities are provided: rce.py: Provides a reverse shell or adds an arbitrary administrator from unprivileged access to th...

CVE-2026-18322

CVE-2026-18322 — Smart Popup by Supsystic Privilege Escalation Security research on CVE-2026-18322 , an unauthenticated privilege-escalation vulnerability in the WordPress plugin Smart Popup by Supsystic popup-by-supsystic. This repository contains a root-cause analysis derived from the upstream...

Exploit for CVE-2026-61628

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

Exploit for CVE-2024-31218

CVE-2024-31218 — Webhood / PocketBase Authentication Bypass La...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation E...

wp2exp-2026

wp2exp2026 🔥 WordPress All-in-One Exploit Framework — Detector · Scanner · Enumerator · Exploit · Escalation wp2exp2026 is the rebranded, battle-tested successor of the wp2shell framework. It merges the original wp2shell checker/exploit chain, three public CVE-2026-63030 PoC kits Ch4120N,...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server versions 26.7.3 and earlier fail to propagate the authenticated principal to async worker threads, making the scripting authorization gate a no-op. A read-only user can submit a JavaScript command via /api/v1/command with awaitResponse:false to execute arbitrary code and create a ...

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...