EIPP

EIPP Banned Password Lists Tools for manipulating Banned Password Lists BPL of Entra ID Password Protection. The eipp-global-bpl.txt containing the entries of the global banned password list was dumped on 2024-04-11. More info at...

captaincredz

CaptainCredz TL;DR CaptainCredz is a modular and discreet password-spraying tool, with advanced features such as a cache mechanism and a fine-grained timing control. To start using captaincredz, the following lines may be useful: TEXTEDITOR=nano git clone https://github.com/synacktiv/captaincredz...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

CVE-2023-32243-Detection-and-Mitigation-in-WordPress

🔐 CVE-2023-32243 – Detección y Mitigación en WordPress 📘 Título del Proyecto: Detección y Mitigación de CVE-2023-32243 en el Plugin Essential Addons for Elementor de WordPress 🧠 Resumen Este proyecto explora la explotación y prevención de CVE-2023-32243 , una vulnerabilidad crítica de escalada de...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Toma de Control de Cuenta por Restablecimiento de Contraseña de Flowise ATO Solo para fines de investigación y pruebas! No soy responsable de ningún daño a infraestructura en vivo si esta herramienta no se utiliza según lo previsto. Úsela solo en sistemas que posea o tenga permiso para probar! Us...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 - unauthenticated privilege escalation via arbitrary password reset A critical improper-authentication flaw in the WordPress plugin SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. When OTP verification is enabled for password...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Metabase unauthenticated SQL injection detector + analysis -black Unauthenticated SQL injection in Metabase via POST /api/session/resetpassword. CVSS 10.0 , in the CISA KEV catalog, exploited in the wild. An undeclared field in the password-reset request body reaches the...

CVE-2026-19632-POC

CVE-2026-19632 — TranslatePress Unauthenticated Account Takeover Unauthenticated Account Takeover via Password Reset Link Disclosure Contact TG:@soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN 🎥 Video...

CVE-2026-19632

TranslatePress Password Reset Link Disclosure to Administrator Account Takeover CVE: CVE-2026-19632 | CVSS: 9.8 Critical Unauthenticated account-takeover via TranslatePress plugin for wordpress. Time from CVE publication to working Day-One PoC: 5 hours, 9 minutes, 40 seconds Up to and including...

keycloak-CVE-2026-18963

CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM Auth Bypass + Root Password Changer This script exploits an authentication bypass vulnerability in cPanel/WHM CVE-2026-41940 using a CRLF injection technique to forge an administrator session. Once successful, the script can change the root user's password in WHM and...

CVE-2020-29669

=============== Macally WIFISD2-2A82 Writeup for CVE-2020-29669 by Maximilian Barz Silky and Daniel Schwendner code-byter ========================== This is a writeup of exploiting the Macally WIFISD2-2A82 Travel Router Firmware version: 2.000.010. The Guest user is able to reset its own password...

passera

ملاحظة: لم يعد لدي وقت لمواصلة تطوير Passera، ولكن طلبات السحب Pull Requests مرحب بها أكثر من أي وقت مضى! العنصر الأكثر طلباً هو إضافة محدثة لمتصفح Firefox، حيث أن أحدث تغيير في واجهة API عطل الإصدار الحالي. Passera أداة بسيطة تسمح للمستخدمين بالحصول على كلمات مرور قوية وفريدة لكل موقع ويب، دون...

passera

Note: I no longer have the time to continue development of Passera, but pull requests are more than welcome! The number one requested item would be an updated Firefox extension, since the latest API change broke the current release. Passera A simple tool that allows users to have strong unique...

msspray

Note: This repository is no longer being developed msspray.py MSSpray is used to conduct password spray attacks against Azure AD as well as validate the implementation of MFA on Azure and Office 365 endpoints ------------------------------------------------------------ | ;--- Check each endpoint...

AI-PASSWORD-TESTING-AGENT

Orquestador de Ataques de Contraseñas con IA La fuerza bruta está muerta. El nuevo ataque de contraseñas aprende. Este repositorio es la investigación detrás de esa afirmación: un análisis técnico de cómo la IA transforma los ataques de contraseñas de una enumeración ciega en campañas adaptativas...

CVE-2023-28432

CVE-2023-28432 MinIO Information Disclosure Leaks Account Passwords The MinIO system has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all sensitive information, including MINIOSECRETKEY and MINIOROOTPASSWORD, by sending a specially crafted POST request to...

CVE-2023-7028

Introduction GitLab is a widely adopted web-based repository manager that provides a comprehensive platform for managing source code, integration, maintenance, and collaboration in software development projects. CVE-2023-7028 is a vulnerability that allows an attacker to take over user accounts...

pepe

PEPE - Correos Electrónicos de Pastebin para Post-Explotación Recopila información sobre direcciones de correo electrónico filtradas de Pastebin Acerca de El script analiza los volcados de email:contraseña de Pastebin y recopila información sobre cada dirección de correo electrónico. Soporta...