HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host Content-type:...

CVE-2026-124680 Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in Incorrect Authorization vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. Th...

CVE-2026-124680

Apache APISIX versions 0.9 through 3.19.0 are vulnerable to an Interpretation Conflict leading to Incorrect Authorization . An unauthenticated client can bypass route-level auth plugins by accessing upstream paths when a route without authentication exists on the same upstream, provided the upstr...

CVE-2024-4040

Exploit Code for CVE-2024-4040 Overview This exploit code targets the CVE-2024-4040 vulnerability, allowing unauthorized access to user accounts by reading and validating tokens stored in the "sessions.obj" file. If the tokens are valid, hackers can gain entry to the targeted accounts. Unlike oth...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Superset, a widely used open-source tool for data visualization and exploration, has been identified as having potential security weaknesses that could lead to authentication bypass and remote code execution RCE. These vulnerabilities cou...

proftpd-CVE-2026-42167-analysis

CVE-2026-42167 — ProFTPD modsql SQL Injection / Auth Bypass / RCE Independent reproduction, code-level root-cause walkthrough, and a frank exposure analysis for CVE-2026-42167 — the isescapedtext bypass in ProFTPD's modsql logging pipeline disclosed by ZeroPath Research and fixed in ProFTPD 1.3.9...

day10-nextjs-middleware-lab

Day 10 — Next.js middleware auth-bypass lab CVE-2025-29927 simulation Important: Educational lab only. Run locally in Docker. Quickstart: npm i build from repo root with files above docker build -t day10-nextjs-lab . run docker run --rm -d -p 8080:3000 --name day10 day10-nextjs-lab Open...

CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Authenticated Subscriber+ Telegram Bot Token Disclosure to Authentication Bypass Description The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on th...

watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819 FreePBX Pre-Auth RCE FreePBX Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to upload the php script or adds a new user if the upload fails. $ python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://freepbx.lab.local /...

cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass → admin takeover CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · disclosed 2026-08-28 · exploited in the wild. An unauthenticated, network-adjacent attacker mints a platform administrator access token against a default...

transfer.sh

Policy on providing or accepting a fix for a Vulnerability Any vulnerability discovered through LLM analysis, or other equivalent fashion, is totally up to my discretion to be fixed or a fix for it to be accepted. People relying to such technologies for finding vulnerabilities are the only people...

cve-2026-20127

CVE-2026-20127 Scanner Overview This project is a Windows-based network scanning tool written in C++ that attempts to identify potential Cisco SD-WAN / vManage-like services and perform a vulnerability check against a referenced issue labeled CVE-2026-20127. Features IP range scanning start → end...

CVE-2025-61455

🛡️ CVE Disclosure: CVE-2025-61455 — SQL Injection in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61455 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in E-commerce Project v1.0, specifically within the signup.inc.php endpoint. The...

CVE-2022-36537

CVE-2022-36537 Summary R1Soft Server Backup Manager uses the ZK framework as the main framework. Its security requires all Web3 project parties to pay more attention to the security vulnerabilities of various Web3 infrastructures and patch them in time to avoid potential security risks and digita...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. Auth Bypass Add X-Forwarded-For header to bypass authentication, note that its value is not a fixed value. Brute Force Use Burp Intruder to fuzz test the values of hostid and localdataids. RCE The point of...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host Content-type:...

CVE-2026-0073

ADB TLS Auth Bypass Exploit CVE-2026-0073 An automated network scanner and exploitation tool for CVE-2026-0073 , a vulnerability in the Android Debug Bridge daemon adbd that allows unauthenticated Remote Code Execution RCE and interactive shell access via Wireless Debugging. This tool is...

CVE-2026-24061

CVE-2026-24061 - telnetd auth bypass What it's about Argument injection in telnetd from GNU InetUtils. Versions 1.9.3 to 2.7. CVSS 9.8. On the CISA KEV list since 26.01.2026, meaning it's actively exploited in the wild. The whole trick is that telnetd takes the value of the USER environment...