CVE-2026-18030

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

CVE-2026-16298

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16299

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-14237

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

Dahua Devices - Path Traversal Account Leak (CVE-2024-13130)

Multiple Dahua devices and OEMs allow path traversal to ../mtd/Config/Sha1Account1 or Account1, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM path traversal to account config files CVE-2024-13130.""" from kittysploit import from...

SoftPerfect Bandwidth Manager - Auth Bypass Detection

Detects SoftPerfect Bandwidth Manager auth bypass via Basic AAAA and XML getoptions returning . !/usr/bin/env python3 -- coding: utf-8 -- """SoftPerfect Bandwidth Manager Basic Auth bypass / password disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link - rtpd.cgi Password Disclosure Detection (CVE-2013-1599)

Detects CVE-2013-1599 by requesting /cgi-bin/rtpd.cgi?echo&AdminPasswdss|tdb&get&HTTPAccount. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link rtpd.cgi password disclosure CVE-2013-1599.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PTZOptics Camera - Unauth System Config / Password Leak (CVE-2024-8956)

PTZOptics cameras expose /cgi-bin/param.cgi?getsystemconf without authentication, leaking userpasswd hashes CVE-2024-8956. Presence also indicates the related OS command injection CVE-2024-8957. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics camera insufficient auth leaking password hash...

NETGEAR DGND3700v2 - Password Recovery Detection (PSV-2021-0343)

NETGEAR DGND3700v2 exposes admin credentials via /setup.cgi?nextfile=passwordrecovered.htm without authentication PSV-2021-0343. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGND3700v2 unauthenticated admin password recovery PSV-2021-0343.""" import re from kittysploit import from...

Dahua Devices - Path Traversal Account Dump (CVE-2024-13130)

Exploits path traversal to ../mtd/Config/Sha1Account1 or Account1 on Dahua and OEM devices, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua/OEM path traversal to account config CVE-2024-13130.""" from kittysploit import from lib.protocols.http.httpclient...

NETGEAR DGND3700v2 - Unauth Password Recovery Dump

Retrieves admin username/password from /setup.cgi?nextfile=passwordrecovered.htm on NETGEAR DGND3700v2 PSV-2021-0343. !/usr/bin/env python3 -- coding: utf-8 -- """Dump NETGEAR DGND3700v2 admin credentials via password recovery page.""" import re from kittysploit import from...

CVE-2026-14237 Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

CVE-2026-14237

The Vitepos WordPress plugin (versions before 3.6.0) and the Vitepos Lite plugin (versions before 3.5.0) are vulnerable to a privilege escalation flaw. The root cause is a failure to perform a per-target authorization check within the point-of-sale password-reset API. By default, the plugin grant...

CVE-2026-14237 Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

CVE-2026-14237

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

EUVD-2026-54992

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

EUVD-2026-55032

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...