CVE-2026-85978 Unauthenticated Remote Code Execution in Akana API Platform

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates...

CVE-2026-85978 Unauthenticated Remote Code Execution in Akana API Platform

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates...

CVE-2023-51467

CVE-2023-51467 exp.py changed to command execution Post.txt Serialization vulnerability exploitation bypassauth.txt Authentication bypass test Vulnerability cause Due to the incorrect use of empty values during authentication checks, this method did not take effect, leading to authentication...

CVE-2019-20933

CVE-2019-20933 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret. see https://nvd.nist.gov/vuln/detail/CVE-2019-20933 For more details PoC This PoC exploit...

CVE-2016-2555

CVE-2016-2555 Exploit This exploit targets a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor 2.2.1. By exploiting these vulnerabilities, the attacker can upload malicious code to achieve Remote Code Execution RCE on the vulnerable server. Usage root@kitploit: $...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

CrushFTP-CVE-2024-4040-illdeed

CVE-2024-4040 — CrushFTP Authentication Bypass Exploit This repository contains a stealthy Python proof-of-concept PoC exploit for CVE-2024-4040 , a critical vulnerability in CrushFTP v10 and below that allows an attacker to bypass authentication using a forged CrushAuth cookie and AWS-style...

CVE-2026-35616

CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass to RCE TL;DR A critical authentication bypass in Fortinet FortiClient EMS 7.4.5 and 7.4.6 allows a completely unauthenticated, remote attacker to bypass API authentication by spoofing a single HTTP header X-SSL-CLIENT-VERIFY. The flaw...

CVE-2026-41651-analysis

CVE-2026-41651 — Pack2TheRoot Analysis PackageKit Local Privilege Escalation TOCTOU Race Condition CVSS v3.1: 8.8 HIGH | CWE-367 | Published: 2026-04-22 📌 Overview This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability...

CVE-2025-29927-PoC

CVE-2025-29927: PoC de Bypass de Middleware de Next.js Este repositorio contiene una prueba de concepto PoC para CVE-2025-29927, una vulnerabilidad en el middleware de Next.js que permite eludir las comprobaciones de autenticación y autorización mediante la manipulación de cabeceras. Detalles de ...

CVE-2024-4358

CVE-2024-4358 / CVE-2024-1800 Telerik Report Server deserialization and authentication bypass exploit chain for CVE-2024-4358/CVE-2024-1800 Technical Analysis A root cause analysis of the vulnerability can be found on my blog Usage root@kitploit: python CVE-2024-4358.py --target...

CVE-2026-20127

CVE-2026-20127 Overview An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127. This exploit targets the vbondprocchallengeackack handler. It sends a forged CHALLENGEACKACK message msgtype=10 with an attacker-controlled verifystatus=1 byte, directl...

copyfail-rs

copyfail-rs Multi-vector PoC + paired detection for CVE-2026-31431 CopyFail. Includes a novel PAM auth-bypass vector that no other public PoC ships. Detection mode catches what AIDE / Wazuh / OSSEC / Tripwire structurally cannot. Single static binary. 108 KB. nostd musl. Demo root@kitploit:...

CVE-2023-2982-POC

CVE-2023-2982 WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 - Omisión de autenticación WordPress社交登录和注册（Discord，Google，Twitter，LinkedIn）=7.6.4-绕过身份验证 Info El plugin de WordPress Social Login and Register Discord, Google, Twitter, LinkedIn es vulnerable a una omisi...

CVE-2018-10933

Recreate & improve scenario of CVE-2018-10933 Explaination root@kitploit: This is educational purpose for CVE-2018-10933, which is libSSH bypass authentication! libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an...

CVE-2020-2733

CVE-2020-2733 - JD Edwards EnterpriseOne Tools admin password not adequately protected Pic 1: Decrypt the string Pic 2: Decrypt by giving the URL CVE-2020-2733 Application: JD Edwards EnterpriseOne Tools Versions Affected: JD Edwards EnterpriseOne Tools 9.2 Vendor URL: https://oracle.com/ Bug:...

CVE-2022-40684

CVE-2022-40684 Puntuación CVSS: 9.6 POC para CVE-2022-40684 que afecta a los dispositivos Fortinet FortiOS, FortiProxy y FortiSwitchManager. Productos Vulnerables Versiones de FortiOS entre 7.0.0 – 7.0.6 y 7.2.0 – 7.2.1 Versiones de FortiProxy entre 7.0.0 – 7.0.6 y la versión 7.2.0 Versiones de...

CVE-2025-29927-PoC

CVE-2025-29927: Vulnerabilidad de Bypass de Middleware en Next.js PoC Este repositorio demuestra la vulnerabilidad CVE-2025-29927 en Next.js, donde el encabezado interno x-middleware-subrequest puede usarse para eludir las comprobaciones de middleware como la autenticación. Versiones Afectadas...

proftpd_bypass

Esta herramienta utiliza una cadena de comandos especialmente diseñada para explotar CVE-2015-3306 y eludir el sistema de autenticación de modcopy de ProFTPD. Se puede descargar aquí deberá ejecutarlo desde la línea de comandos Uso: proftpdbypass target port lcopy within target/rcopy to target...

cve-2026-39987

cve-2026-39987 Installation • Usage • Examples I'm just trying out Go :D Btw: CVE-2026-39987 PoC: Marimo:PORT/terminal/ws REDACTED@REDACTED:$ uname -a Linux ... REDACTED@REDACTED:$ exit exit INF:normalclose websocket: close 1000 normal: Terminal session ended Custom Command -c: r...