CVE-2025-54918-POC

CVE-2025-54918 – Proof of Concept PoC ⚠️ Important Notice IMPORTANT: To test CVE-2025-54918 , you must create a DNS record in the target Active Directory environment. Always consult with the client and obtain explicit authorization before testing, as this can impact DNS and authentication behavior...

vault-conductor

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...

CVE-2026-89209

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.4, Mendix SAML Mendix 11 compatible All versions V4.2.4, Mendix SAML Mendix 9 compatible All versions V3.6.29. Affected versions of the module do not properly protect against SAML assertion replay in...

CVE-2026-116257

A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack ...

CVE-2026-80312

CVE-2026-80312 — camel-oauth: fail-open authentication guard Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an...

webscreenshot

webscreenshot Description A simple script to screenshot a list of websites, based on the url-to-image PhantomJS script. Features Integrating url-to-image 'lazy-rendering' for AJAX resources Fully functional on Windows and Linux systems Cookie and custom HTTP header definition support for the...

CVE-2026-8181

| Authentication Required 💥 CVE-2026-8181 - Burst Statistics Authentication Bypass Unauthenticated Privilege Escalation via MainWP Authentication Bypass 👨‍💻 Author !0xTerrorhttps://assets.kitploit.com/production/public/readmes/50604/f036bd5517ab1ec023381e336e314b53384b618d5a934600f6128...

cve-2021-21994_POC

CVE-2021-21994 — VMware ESXi SFCB Authentication Bypass — Lab Research Kit Field| Value ---|--- Type| CWE-287 Improper Authentication auth bypass Component| SFCB Small Footprint CIM Broker inside VMware ESXi Attack vector| Network, TCP 5989 CIM-XML over HTTPS, "specially crafted request" Affected...

OSWE-Labs-Poc

OSWE -LABS Dockerized labs For Web Expert OSWE certification. Preparation for coming AWAE Training ... Another project : malware analysis & cyber threat hunting https://github.com/svdwi/BlueBox Available labs for the OSWE 1. ATutor is an Open Source Web-based Learning Content Management System...

CVE-2026-24061

CVE-2026-24061 Vulnerability Batch Detection Tool ⚠️ Note : CVE-2026-24061 GNU Inetutils is a classic set of network tools provided by the GNU project, which includes the telnetd service, i.e., the Telnet server daemon. In versions 1.9.3 through 2.7, the telnetd service has a fatal flaw in the use...

CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

MAL-003

MAL-003: Groovy Security Bypass and Stored XSS in Apache OfBiz A Groovy RCE and XSS have been identified in Apache OfBiz = 18.12.05. Why no CVE? Apache OfBiz does not create CVEs for "post-auth attacks done using demo credentials, notably using the admin user" as mentioned on their security page...

CVE-2026-14378-DevKit-Pro-Auth-Bypass

CVE-2026-14378 — Unauthenticated Authentication Bypass in WordPress DevKit Pro Plugin -red.svg Table of Contents 1. Executive Summary 2. Vulnerability Breakdown 3. Root Cause & Technical Analysis 4. Full Attack Walkthrough Step-by-Step Step 0: Environment Setup Step 1: Confirm Plugin Is Installed...

CVE-2022-23131

CVE-2022-23131 Zabbix - SAML SSO Authentication Bypass Description In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor, because a user login stored in the session was not verified. Dork: shodan-query:...

sipcheck

SIPCheck v.3.0 Introduction SIPCheck is a tool that watch the authentication of users of Asterisk and bans automatically if some user or bot try to register o make calls using wrong passwords. Unlike Fail2Ban, SIPCheck manage, not just the attacker, also the clients that you have trust so if you...

enumpossible

enumpossible Checks a list of SSH servers for password-based auth availability and for the existence of SSH user enumeration vulnerability CVE-2018-15473 in those identified. Uses a slightly modified version of https://www.exploit-db.com/exploits/45939 by @LeapSecurity to check for CVE-2018-15473...

CVE-2024-52475

CVE-2024-52475 WordPress Wawp Plugin = 3.0.17 is vulnerable to Broken Authentication Account takeover Disclaimer! The information provided in this document regarding for CVE-2024-52475 is for learning and educational purposes only. We do not encourage or authorize the use of this information for...

kerbrute

Kerbrute A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication Grab the latest binaries from the releases page to get started. Background This tool grew out of some bash scripts I wrote a few years ago to perform bruteforcing using the...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 with Metasploit-Framework The CVE-2019-0708 vulnerability exploits a flaw in user authentication, allowing bypass of authentication without any interaction. It directly connects via the RDP protocol to send malicious code and execute commands on the server. If exploite...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when succesfully performing the bypass, and not perform any...