CVE-2026-35616

CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass to RCE TL;DR A critical authentication bypass in Fortinet FortiClient EMS 7.4.5 and 7.4.6 allows a completely unauthenticated, remote attacker to bypass API authentication by spoofing a single HTTP header X-SSL-CLIENT-VERIFY. The flaw...

CVE-2026-41651-analysis

CVE-2026-41651 — Pack2TheRoot Analysis PackageKit Local Privilege Escalation TOCTOU Race Condition CVSS v3.1: 8.8 HIGH | CWE-367 | Published: 2026-04-22 📌 Overview This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass PoC This repository contains a proof of concept PoC for CVE-2025-29927, a vulnerability in Next.js middleware that allows bypassing authentication and authorization checks through header manipulation. Vulnerability Details Affected Versions : = 11.1.4,...

CVE-2024-4358

CVE-2024-4358 / CVE-2024-1800 Telerik Report Server deserialization and authentication bypass exploit chain for CVE-2024-4358/CVE-2024-1800 Technical Analysis A root cause analysis of the vulnerability can be found on my blog Usage root@kitploit: python CVE-2024-4358.py --target...

CVE-2026-20127

CVE-2026-20127 Overview An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127. This exploit targets the vbondprocchallengeackack handler. It sends a forged CHALLENGEACKACK message msgtype=10 with an attacker-controlled verifystatus=1 byte, directl...

copyfail-rs

copyfail-rs Multi-vector PoC + paired detection for CVE-2026-31431 CopyFail. Includes a novel PAM auth-bypass vector that no other public PoC ships. Detection mode catches what AIDE / Wazuh / OSSEC / Tripwire structurally cannot. Single static binary. 108 KB. nostd musl. Demo root@kitploit:...

CVE-2023-2982-POC

CVE-2023-2982 WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 - Authentication Bypass WordPress社交登录和注册（Discord，Google，Twitter，LinkedIn）=7.6.4-绕过身份验证 Info The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to...

CVE-2018-10933

Recreate & improve scenario of CVE-2018-10933 Explaination root@kitploit: This is educational purpose for CVE-2018-10933, which is libSSH bypass authentication! libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an...

CVE-2020-2733

CVE-2020-2733 - JD Edwards EnterpriseOne Tools admin password not adequately protected Pic 1: Decrypt the string Pic 2: Decrypt by giving the URL CVE-2020-2733 Application: JD Edwards EnterpriseOne Tools Versions Affected: JD Edwards EnterpriseOne Tools 9.2 Vendor URL: https://oracle.com/ Bug:...

CVE-2022-40684

CVE-2022-40684 CVSS score: 9.6 POC for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Vulnerable Products FortiOS versions between 7.0.0 – 7.0.6 and 7.2.0 – 7.2.1 FortiProxy versions between 7.0.0 – 7.0.6 and version 7.2.0 FortiSwitchManager versions 7.0...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass Vulnerability PoC This repository demonstrates the CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions Next.js 15.x 15.2.3 Next.js 14.x...

proftpd_bypass

Esta herramienta utiliza una cadena de comandos especialmente diseñada para explotar CVE-2015-3306 y eludir el sistema de autenticación de modcopy de ProFTPD. Se puede descargar aquí deberá ejecutarlo desde la línea de comandos Uso: proftpdbypass target port lcopy within target/rcopy to target...

cve-2026-39987

cve-2026-39987 Installation • Usage • Examples I'm just trying out Go :D Btw: CVE-2026-39987 PoC: Marimo:PORT/terminal/ws REDACTED@REDACTED:$ uname -a Linux ... REDACTED@REDACTED:$ exit exit INF:normalclose websocket: close 1000 normal: Terminal session ended Custom Command -c: r...

CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---Critical-Authentication-Bypass- CVE-2025-41646 - Critical Authentication bypass 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC A critical authentication bypass vulnerability CVE-2025-41646 in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as admin without val...

salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

1 What is it? Scanning tool to test for SaltStack vulnerabilities CVE-2020-11651 & CVE-2020-11652. The vulnerabilities allow an attacker who can connect to the "request server" port to bypass all authentication and authorization controls and publish arbitrary control messages, read and write file...

offensive-security-writeups

Offensive Security Write-ups from the CTF challenges tackled...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 with Metasploit-Framework The CVE-2019-0708 vulnerability exploits a flaw in user authentication, allowing bypass of authentication without any interaction. It directly connects via the RDP protocol to send malicious code and execute commands on the server. If exploite...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - Auth bypass extract admin users and LDAP config - This PoC do only read-only actions. Run exploit root@kitploit: USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Run nuclei template root@kitploit: echo https://target.com | nuclei...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when succesfully performing the bypass, and not perform any...

SecuraBV-CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when succesfully performing the bypass, and not perform any...