CVE-2018-15473

You will need Python 2.7 to use this exploit. install all the module given bellow in python 2.7 Like: python2 -m pip install numpy python2 -m pip install paramiko python2 -m pip install property To test single username use this command: python ./sshuserenumeration.py -u Like: python...

CVE-2019-20933

LAB 5-CVE-2019-20933 I. SYSTEM ANALYSIS Identifying the Attack Surface Starting with what is running in the environment. I list all active containers: docker ps The victim exposes a single port:8086. Currently, I do not have detailed information about the target. From the docker ps output, the...

Alibab-Nacos-Unauthorized-Login

Vuln Impact An issue has been discovered in Nacos affecting Nacos = 2.1.0.Nacos users use the default JWT key to cause an unauthorized access vulnerability. Through this vulnerability, attackers can bypass user name and password authentication and directly log in to the Nacos user Vuln Product...

CVE-2025-47646

🔐 CVE-2025-47646 – PSW Front-end Login & Registration = 1.12 📌 Plugin Information Plugin : PSW Front-end Login & Registration Vulnerable Version : = 1.12 CVE : CVE-2025-47646 Severity : High CVSS 9.8 Vulnerability Type : Broken Authentication Privilege Required : Unauthenticated Patched : ❌ No...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP Unauthenticated RCE Vulnerability F5 BIG-IP iControl REST身份验证绕过RCE漏洞 fofa keywords: title="BIG-IP- Redirect" usage attack $ python3 cve-2022-1388.py -t https://203.xxx.xxx.xxx + https://203.xxx.xxx.xxx is vulnerable input your command:...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API aka phishing API, which might allow ... 2. CVE-2025-69413 - In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on...

CVE-2022-41082

CVE-2022-41082 This repository contains a proof-of-concept PoC tool for exploiting the OWASSRF vulnerability CVE-2022-41082 in Microsoft Exchange servers. The exploit allows attackers to execute arbitrary commands on the server, potentially compromising the system. Overview The tool leverages an...

CVE-2024-4358

Telerik Report Server Authentication Bypass - CVE-2024-4358 Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicabl...

CVE-2025-69985

CVE-2025-69985: Exploit for Authentication Bypass to RCE in FUXA ≤1.2.8 📌 General Description This repository contains a Proof of Concept PoC and detailed technical documentation about the vulnerability CVE-2025-69985 , which affects FUXA versions ≤1.2.8. The vulnerability allows an unauthenticat...

CVE-2024-1709

CVE-2024-1709 A Scanner for CVE-2024-1709 - ConnectWise SecureConnect Authentication Bypass Vulnerability Usage create a "hosts.txt" file within the script's directory and include the hosts you intend to scan in the file. Follow me on social media: X: https://x.com/HussainMFathy LinkedIn:...

cpanelCVE-2026-41940

🔴 cPanelCVE CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS 10.0 Critical · Confirmed In‑The‑Wild · Auto Root Login 📖 Overview cPanelCVE is a proof‑of‑concept exploit for CVE-2026-41940, a critical session‑file CRLF injection vulnerability in cPanel & WHM that allows complete root...

cve-2026-33032-scanner

CVE-2026-33032 Scanner Non-destructive vulnerability scanner for Nginx-UI MCP Endpoint Authentication Bypass Vulnerability Overview CVE-2026-33032 is an authentication bypass vulnerability in nginx-ui's Model Context Protocol MCP integration. The /mcpmessage endpoint lacks authentication middlewa...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2021-33766

POC Exploit CVE-2021-33766 ProxyToken POC Exploit for CVE-2021-33766 ProxyToken is a handy shell script which provides pentesters and security researchers a quick and effective way to test Microsoft Exchange ProxyToken vulnerability. Disclaimer This program is for Educational purpose ONLY. Do not...

CVE-2026-116070

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems link...

sshamble

sshamble SSHamble is a research tool for SSH implementations that includes: Interesting attacks against authentication Post-session authentication attacks Pre-authentication state transitions Authentication timing analysis Post-session enumeration This project is a work-in-progress and likely to...

CVE-2026-24061-GNU-Inetutils-telnetd-Remote-Authentication-Bypass-Root-Shell-

🧨 Overview This repository contains a Proof‑of‑Concept exploit for GNU Inetutils telnetd remote authentication bypass vulnerability. The issue arises because telnetd improperly sanitizes the USER environment variable received via Telnet NEW‑ENVIRON negotiation before invoking /bin/login. By...

CVE-2024-55591-POC

ScaryByte R&D PoC for CVE-2024-55591 A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability CVE-2024-55591 in certain Fortinet devices. This script: 1. Installs Missing Dependencies automatically 2. Optionally Scans a...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...