CVE-2026-59074

Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​ obtain​ ​a ​​valid,​​ fully-signed​​...

CVE-2017-11427-DEMO

CVE-2017-11427-DEMO Basic Environment $ sudo apt-get install libxml2-dev libxslt1-dev $ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl DEMO: $ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git $ cd CVE-2017-11427-DEMO $ source venv/bin/active $ cd vulnsaml $ python...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

Auto-Elevate

Auto-Elevate This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method 41 ICMLuaUtil UAC bypass...

SharpImpersonation

SharpImpersonation This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

CVE-2020-8289

CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backblaze Summary Name: Remote Code Execution as SYSTEM/root via Backblaze CVE: CVE-2020-8289 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: Critical Discovery Date: 2020-03-13...

getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not...

RemoteRecon

RemoteRecon Remote Recon and Collection RemoteRecon provides the ability to execute post-exploitation capabilities against a remote host, without having to expose your complete toolkit/agent. Often times as operator's we need to compromise a host, just so we can keylog or screenshot or some other...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...