CVE-2024-0204

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...

CVE-2023-32315

CVE-2023-32315 Tool for CVE-2023-32315 exploitation. Features: Scans single or bulk targets from txt files Utilizes multiprocessing for faster scanning Automatic login capability Installation: Make sure you're in this repo's directory and have python3 installed Install required packages using: pi...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

PoC_CVE-2025-54887

PoCCVE-2025-54887 This repository contains Proof-of-Concept PoC exploit for CVE-2025-54887. This is a vulnerability in ruby-jwe version = 1.1.0 where the authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality and provide ways to craft arbitrary JWEs...

CVE-2024-4040

CVE-2024-4040 A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform...

github-search

github-search A collection of tools to perform searches on GitHub. Install git clone https://github.com/gwen001/github-search cd github-search pip3 install -r requirements.txt Most of the time GitHub requires a token to perform searches. You can create a .tokens file in the cloned repo directory...

CVE-2026-24031

CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...

CVE-2024-7479_CVE-2024-7481

CVE-2024-7479 & CVE-2024-7481 TeamViewer User to Kernel Elevation of Privilege This repository contains the exploit proof of concept of a vulnerability in TeamViewer that enables an unprivileged user to load an arbitrary Kernel Driver into the system. I would like to thank Zero Day Initiative for...

PetitPotam

PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...

CVE-2026-116123

A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack ...

wp2shell-rce

WP2Shell RCE An assessment and scanning utility designed to detect exposure to the WP2Shell exploit chain in WordPress Core installations across single endpoints or large target lists. ⚠️ Disclaimer Only scan systems you own or are authorized to assess. Unsanctioned scanning or testing of...

CVE-2026-41940_exploit

============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...

cve-2018-11714_POC

cve-2018-11714POC An issue was discovered on TP-Link TL-WR840N. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. artigo pt-br:...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 is an authentication bypass resulting in an information leak on Joomla! Servers. Although rated as a CVSSv3 5.3 Medium severity by NVD, this vulnerability could allow an attacker to achieve code execution under the right circumstances. That likely justifies the...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

LR-WebPKI

LR+ WebPKI Evaluation Artifact This package contains the finalized LR+ reference implementation, production reconstruction wrappers, tests, and generated evaluation outputs for context-closed post-quantum authentication over WebPKI CA context. The package is intentionally written as a submission...

research-cve-2026-85649

CVE-2026-85649 | Holloway Chew, Kean Ho's Knowledge Research On 2026-08-26, a security vulnerability CVSS: 7.9, High7 was reported in Holloway Chew, Kean Ho's Actualizer v1.2.0 and below. The tool assumed that the mkpasswd command always produces a valid yescrypt password hash. In situations wher...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2023-42793-TeamCity-Unauthenticated-RCE

CVE-2023-42793 - JetBrains TeamCity Security Assessment Tool This repository provides a Python-based utility designed to assess and demonstrate the security implications of CVE-2023-42793 , a critical vulnerability affecting on-premises JetBrains TeamCity servers. Vulnerability Details CVE...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...