Mass-CVE-2023-28121

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User Introduction This script using Python3 and use threading for better process speed. The script has ben updated to 2 version. V1 is the old version and V2 the newer version with random username, ema...

CVE-2024-0204

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...

CVE-2026-10030

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2024-27956-RCE

CVE-2024-27956-RCE Un PoC pour CVE-2024-27956, une injection SQL dans le plugin ValvePress Automatic. Ce PoC exploite la vulnérabilité en créant un utilisateur sur la cible et en lui donnant des droits d'administrateur. Être administrateur dans WordPress peut mener à l'exécution de code à distanc...

CVE-2020-6287_SAP-NetWeaver-bypass-auth

CVE-2020-6287SAP-NetWeaver-bypass-auth Exploit automatisé pour CVE-2020-6287 CVE-2020-6287 : SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, n'effectue pas de contrôle d'authentification, ce qui permet à un attaquant sans authentification préalable d'exécuter des...

CVE-2014-3704

Conversion du code en Python 3 Ce code est tiré de "Drupal 7.0 7.31 - 'Drupalgeddon' SQL Injection Add Admin User" et a été converti en Python 3 pour s'adapter à l'exercice dans Academy pour le module "Attacking Commoon Applications" et la section "Attacking Drupal". Le code original a été écrit ...

CVE-2024-27956

Exploit d'injection SQL du plugin WP Automatic CVE-2024-27956 Un exploit de preuve de concept pour la vulnérabilité d'injection SQL dans le plugin WP Automatic CVE-2024-27956 affectant les sites WordPress. 📌 Description Cet exploit cible une vulnérabilité critique d'injection SQL non authentifiée...

CVE-2022-31294

CVE-2022-31294 Site de forum de discussion en ligne 1.0 - Prise de contrôle de compte Titre de l'exploit : Site de forum de discussion en ligne 1.0 - CSRF Créer un nouvel utilisateur administrateur / Mettre à jour un utilisateur existant Prise de contrôle de compte Date : 2022-06-13 CVE :...

connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 et CVE-2024-1709 Une preuve de concept développée par @watchTowr pour exploiter un contournement d'authentification afin d'ajouter un nouvel utilisateur administratif dans ConnectWise ScreenConnect. Il s'agit de la première étape d'une chaîne triviale d'exécution de commandes à...

CVE-2017-12542-Exploit

HP iLO Authentication Bypass CVE-2017-12542 This repository contains a proof-of-concept exploit for CVE-2017-12542 , an authentication bypass vulnerability affecting certain versions of HP Integrated Lights-Out iLO firmware. The vulnerability allows unauthenticated access to the iLO REST API, whi...

ProxyLogon-CVE-2021-26855

CVE-2021-26855 This is a modified version of a POC for proxylogon. Instead of laucnhing "whoami" it creates a new user and adds that user to the administrator group and creates a reverse shell. The origonal POC code can be found here: https://www.exploit-db.com/exploits/49663 Usage: python...

CVE-2025-31161

CVE-2025-31161 Wrote an exploit in Go for CVE-2025-31161 affecting crushFTP. Usage root@kitploit: ./exploit -target http://localhost:8085 -user crushadmin -action create-admin -new-admin-user username -new-admin-pass pass...

CVE-2017-12542

CVE-2017-12542 This script checks if an HP iLO server is vulnerable and can add an admin user...

CVE-2023-42793_POC

CVE-2023-42793 Exploit Script Overview This script is designed to automate the exploitation process for the CVE-2023-42793 vulnerability. It targets a specific service presumably affected by this vulnerability and attempts to delete a user token, create a new user token, and then create a new use...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard: обход аутентификации создание обычного и административного Java-пользователя SAP NetWeaver — это интегрированная технологическая платформа SAP и техническая основа всех приложений SAP, начиная с SAP Business Suite. SAP NetWeaver — это...

EUVD-2026-80318

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2024-7593_PoC_Exploit

CVE-2024-7593 Exploit Script This Bash script serves as a proof of concept PoC for exploiting the authentication bypass vulnerability in Ivanti vTM CVE-2024-7593. It allows users to create a new admin user on the target system. Table of Contents Prerequisites Usage Parameters Example Author Licen...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE Proof-of-concept for CVE-2026-44848 , a missing-authentication CWE-862 vulnerability in Portainer that lets a non-admin user with Docker endpoint access perform privileged Docker plugin operations → full host...

CVE-2026-79411

Webkul Bagisto 2.4.9 contains a vertical privilege escalation in the admin user-management component. The user-update endpoint (admin.settings.users.update / UserController::update()) fails to verify that the actor is authorized to grant the requested role, allows a user to change their own role,...

test_cve-2023-46747

Python script to test if a F5 BIG-IP is vulnerable for CVE-2023-46747. When vulnerable a user account with administrator rights is added. To mitigate this vulnerability, see: https://my.f5.com/manage/s/article/K000137353...