Gorse < 0.5.10 - Unauthenticated Database Dump

Gorse 0.5.10 contains an authentication bypass caused by empty adminapikey in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty adminapikey configuration. id: CVE-2026-56782 info: name: Gorse 0.5.10 -...

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users. id: CVE-2026-44825 inf...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

CVE-2019-12562

CVE-2019-12562 CVE-2019-12562 Stored Cross-Site Scripting in DotNetNuke DNN Version vor 9.4.0 erlaubt es entfernten Angreifern, das bösartige Skript in der Admin-Benachrichtigungsseite zu speichern und einzubetten. Der Exploit könnte verwendet werden, um jede Aktion mit Administratorrechten...

CVE-2026-60206

CVE-2026-60206 – Oracle WebLogic Server SAML 认证绕过 PoC 该仓库提供了针对 CVE-2026-60206 的概念验证利用代码，这是 Oracle WebLogic Server SAML 实现中的一个关键认证绕过漏洞。该漏洞允许远程低权限攻击者通过伪造 SAML 断言完全入侵服务器。 ⚠️ 免责声明： 本工具仅限授权的安全研究和测试 使用。仅可对您拥有或获得明确许可的系统进行测试。作者不对滥用行为承担任何责任。 🔥 漏洞概述 CVE-2026-60206 影响 Oracle WebLogic Server 的核心组件。该漏洞源于 SAML...

Tenda-F3-V4

Exploit del router Tenda F3 e downloader di file Questo progetto è uno strumento per scaricare vari file dal router Tenda F3 v3/v4 attraverso una vulnerabilità senza autenticazione CVE-2020-35391. Permette di ottenere il file di configurazione, il log di sistema e il dump della flash da un router...

CVE-2022-42176

PCSecure V5.0.8.xw - Использование жестко заданных учетных данных в файлах конфигурации приводит к доступу к панели администратора Краткое описание Поставщик: PCTechSoft SAS Продукт: PCSecure Затронутые версии: 5.0.8.xw Кодовое имя: PapiQuieroPollo00 Уязвимость Тип: Использование жестко заданных...

CVE-2026-16232

CVE-2026-16232 — Bypass de autenticação do Check Point SmartConsole PoC de bypass de autenticação, de acesso de rede não autenticado a privilégios totais de administrador. Arquivo único, Python 3, apenas biblioteca padrão, zero dependências. Resumo da vulnerabilidade O serviço de login Java do...

CVE-2020-24033

Последняя версия fs.com S3900 24T4S 1.7.1 и все предыдущие версии, CSRF-уязвимость скрытого администратора Форма не имеет механизма аутентификации или токен-аутентификации, поэтому существует межсайтовая подделка запроса добавление учётной записи для создания пользователя с полным доступом. Все...

MakeMeEnterpriseAdmin

Beispiel für eine erfolgreiche Ausführung: root@kitploit: ====================================================================== /\ Elevated domain admins to Enterprise admins - version 1.0 || /||\ Require: domain admin right |:||:| or more specifically DS-Replication-Get-Changes-All |/||| Vincen...

CVE-2021-45232

Уязвимость неавторизованного доступа Apache APISIX Dashboard CVE-2021-45232 Запрос FOFA title="Apache APISIX Dashboard" Затронутые версии Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export Рекомендации по устранению Обновите Apache APISIX Dashboard до последней...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd Сначала получите SessionID гостевого пользователя. SessionID можно найти в любом HTTP-запросе. Например: POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest...

CVE-2025-14340

XSS para tomada de conta de administrador CVE-2025-14340 Uma vulnerabilidade de Cross-Site Scripting na Interface REST de Administração do Payara permite a execução de JavaScript controlado pelo atacante, levando à tomada de conta de administrador. Isso ocorre porque: 1. O painel usa autenticação...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 हम वर्डप्रेस वेब पेज पर पहुँचते हैं जहाँ हम देखेंगे कि इसमें कमजोर प्लगइन के माध्यम से MFA सक्रिय है: हमें PoC चलानी होगी और एक्सेस डेटा प्रदान करना होगा: स्वचालित रूप से, प्रशासन पैनल के भीतर एक अस्थायी .html...

CVE-2025-40554

Suíte de Exploração CVE-2025-40554 Uma ferramenta abrangente de teste de segurança para detectar e explorar a vulnerabilidade de bypass de autenticação CVE-2025-40554 / CVE-2025-40536 no SolarWinds Web Help Desk. ⚠️ Aviso Legal APENAS PARA FINS EDUCACIONAIS E DE TESTES DE SEGURANÇA AUTORIZADOS Est...

CVE-2024-27956

🚨POC ВЫПУЩЕН🚨PoC для SQL-инъекции, приводящей к RCE в Wordpress, выпущен CVE-2024-27956. Создание учётной записи администратора WordPress и Reverse Shell cve-2024-27956 Использование- sudo python3 cve.py...

CVE-2024-33297

CVE-2024-33297 Stored Cross Site Scripting-Schwachstelle in Microweber = 2.0.9 Zusammenfassung : Eine Stored Cross Site Scripting-Schwachstelle in Microweber v.2.0.9 ermöglicht es einem entfernten Angreifer, beliebigen Code über das Feld „Kampagnenname Interner Name“ in der Funktion „Neue Kampagn...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit Boîte à outils d'exploitation CVE-2025-0316 🚨 Exploit de contournement d'authentification pour le plugin WordPress WP Directorybox Manager 🔥 Script d'exploitation automatisé pour CVE-2025-0316 — Contournement d'authentification via une action AJAX vulnérable. ⚠️ Avis légal Ce...

Gallery-Plugin-SQL-Injection

Título do Exploit: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Data: 2024-07-05 Autor do Exploit: tmrswrr Categoria : Webapps Página inicial do fornecedor: https://total-soft.com/wp-video-gallery/ Versão 2.3.6 1. Acesse o Painel Admin: Navegue até o painel adm...

smartermail-CVE-2026-23760-poc

SmarterMail-CVE-2026-23760-poc Uma prova de conceito que explora uma bypass de autenticação via API de redefinição de senha para a conta de administrador do sistema SmarterMail. Vulnerabilidade A vulnerabilidade existe devido a uma falha de bypass de autenticação na API de redefinição de senha. O...