CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

CVE-2022-39299_PoC_Generator

Exploiting CVE-2022-39299 Signature bypass via multiple root elements Advisory : https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 Patch : https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e Base Payload Example Extracted Fro...

CVE-2021-37580

CVE-2021-37580 Apache ShenYu Admin Authentication Bypass...

Pyrescom-Termod-PoC

Pyrescom-Termod-PoC This is the Proof-of-concept exploit code for three vulnerabilities discovered by Jonas Mattsson and Hugo van den Toorn at Outpost24 Ghost Labs. These vulnerabilities are discovered in the web server component on a Pyrescom Termod4 time control machine. These vulnerabilities c...

CVE-2025-55182

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2021-34646

CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...

CVE-2026-23744-POC

CVE-2026-23744 — MCP Server Unauthenticated RCE Proof-of-Concept exploit byd3vn0mi Overview CVE-2026-23744 is an unauthenticated Remote Code Execution RCE vulnerability in MCP-compatible servers exposed on port 6274. The /api/mcp/connect endpoint accepts a serverConfig object that allows callers ...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

Discuz-X5.0-Authentication-Bypass-Exploit-Framework

Discuz! X5.0 Authentication Bypass Exploit Framework ⚡ CVE-2026-49952 | CVSS 9.1 Critical | Version 1.0.0 A professional penetration testing tool designed to identify and demonstrate the critical authentication bypass vulnerability in Discuz! X5.0. 📋 Table of Contents ⚠️ Disclaimer 🔍 Overview 🎯...

Mitel-MiCollab-Auth-Bypass_CVE-2024-41713

CVE-2024-41713 Mitel MiCollab Authentication Bypass to Arbitrary File Read See our blog post for technical details / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / / watchtowr-vs-MiCollab2024-12-05.py Mitel MiCollab Authentication...

CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

CVE-2024-27198

CVE-2024-27198 In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions in TeamCity server, an attacker can take full control over all TeamCity projects, builds, agents and artifacts, finally the attacker will perfomn a RCE. Download git clone...

fortios-auth-bypass-poc-CVE-2024-55591

CVE-2024-55591 A Fortinet FortiOS Authentication Bypass Vulnerable PoC Description Use this poc,you can bypass authentication and see system log USEAGE sysirq@sysirq-machine:/Work/Fortinet/FortiGate7016/CVE-2024-55591$ python3 poc.py usage: poc.py -h --target TARGET --port PORT poc.py: error: the...

poc-cpanel-cve-2026-41940

POC cPanel CVE-2026-41940 A high-performance, multi-threaded security auditing tool designed to detect CVE-2026-41940 , a critical Authentication Bypass vulnerability in cPanel & WHM discovered in April 2026. This tool leverages a CRLF Injection technique in HTTP headers to identify if a cPanel...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit Brute-force Mitigation Bypass Exploit Code for CVE-2019-17240 aka Bludit = 3.9.2 Bruteforce Mitigation Bypass Exploit Links: ExploitDB-48942 PacketStorm Expected outcome: Discover login credentials, bypassing Brute-force Mechanism on host running Bludit =3.9.2...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

CVE-2025-29927

Next.js Vulnerability Demo CVE-2025-29927 This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an x-middleware-subrequest...

CVE-2026-24858

CVE-2026-24858 Vulnerability Analysis Report Full Version with Sources Fortinet FortiCloud SSO Authentication Bypass Vulnerability Document Version : 2.0 Full Source Attribution Version Last Updated : January 29, 2026 Purpose : Security Audit, Technical Documentation, Incident Response 📋 Table of...

cpanelscanner

CpanelScanner CpanelScanner is a Go CLI tool that reads hosts from stdin, probes HTTPS on a configured port default 2087, and checks whether the response contains a configured marker string for example WHM Login. Its intended use is to identify internet-exposed cPanel/WHM instances so they can be...

shiro-cve-2020-17523

Apache Shiro Two Postures Authentication Bypass Analysis CVE-2020-17523 0x01 Vulnerability Description Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro's easy-to-understand API, you can...