Mass-CVE-2026-23550-Exploit

🔥 CVE-2026-23550 Modular DS Scanner Multi-threaded Python scanner for CVE-2026-23550 CVSS 10.0 WordPress Modular DS plugin ≤2.5.1 vulnerability affecting 40k+ sites. Detects unauthenticated admin takeover via getLogin bypass with full wp-admin access verification. Features ✨ 🔥 Full admin access...

CVE-2023-31851

CVE-2023-31851 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/status has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2026-7089-XSS

home-service-system-unauth-stored-xss-admin-takeover Vulnerability Details Field| Details ---|--- Vendor| code-projects.org Product| Home Service System In PHP Version| 1.0 Vulnerability Type| Stored Cross-Site Scripting XSS CWE| CWE-79 Authentication Required| No Author| Imad Alvi Description A...

smartermail-CVE-2026-23760-poc

SmarterMail-CVE-2026-23760-poc A proof-of-concept exploiting an authentication bypass via password reset API for the SmaretMail system administrator account. Vulnerability The vulnerability exists due to an authentication bypass vulnerability in the password reset API. The force-reset-password...

CVE-2026-67279

MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings Exploit tool for authentication bypass vulnerability in WordPress Service Finder Bookings ≤ 6.0 plugin 📋 Table of Contents About the Vulnerability Technical Details...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Unauthenticated Arbitrary Options Update Description The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated...

CVE-2026-30862

CVE-2026-30862 PoC - Privilege Escalation in Appsmith Proof-of-Concept for Privilege Escalation in Appsmith via Stored XSS Disclosure: Originally reported by me via GHSA-5hw4-whxv-6794 ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID| CVE-2026-30862...

CVE-2026-mikrotik-poc

MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — SiYuan MCP Unauthenticated Administrator Takeover Proof of Concept for CVE-2026-66012 CVSS 10.0 Critical, a missing-authorization vulnerability in SiYuan's MCP Model Context Protocol endpoint that allows an unauthenticated attacker to achieve administrator takeover and remote cod...

CVE-2025-2266

🚨 CVE-2025-2266 — WordPress Plugin Exploit 🔍 Vulnerability Summary The Checkout Mestres do WP for WooCommerce plugin for WordPress is affected by an unauthenticated arbitrary options update vulnerability in versions 8.6.5 through 8.7.5. The vulnerable function cwmpUpdateOptions lacks proper...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-8181 Plugin| Burst Statistics – Privacy-Friendly WordPress Analytics Affected Versions| 3.4.0 – 3.4.1.1 Patched Version| 3.4.2 CVSS Score| 9.8 Critica...

CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Metabase — Unauthenticated SQL Injection → Full Administrator Takeover 📌 Overview CVE-2026-72898 is a maximum-severity CVSS 10.0 unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the...

CVE-2026-72898

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection Metabase Pre-Authentication SQL Injection Leading to Admin Takeover Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

CVE-2023-51119

CVE-2023-51119 Improper Access Control on D-Link DIR-605L router Exploitation explanation: Due to an incorrect access control, a takeover can be done over the admin account without any kind of authentication sending a request under special circumstances only needs a legitimate admin to be logged ...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Exploit for CVE-2022-22845 - Unauthenticated Admin Takeover On QXIP SIPCAPTURE Homer-App up to 1.4.27 Discovery: Omri Baso & Fabien Aunay Exploit Author: Omri Baso...

CVE-2026-91097-CVE-2026-91106

🔬 Join Telegram for the latest vulnerability research and exploit releases HPLIP Printer Application — Unauthenticated Admin Takeover Mass exploitation tool targeting the HPLIP Printer Application PAPPL-based web interface in all HPLIP versions before 3.26.6. The tool exploits the default...

CVE-2022-48429_poc

CVE-2022-48429 - YouTrack Stored XSS The reported description of the CVE on the NVD database lacks accuracy. This is a more accurated description: Youtrack version = 2022.3.65373 has a stored Cross-Site Scripting XSS in dashboards. A malicious low-privileged user can create and share a malformed...