CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

teamcity-exploit-cve-2023-42793

TeamCity Exploit Cve 2023 42793 A quick script to exploit the cve-2023-42793 bug. Some additional reading on the exploit can be found here: https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793​...

cve2025-20265

cve2025-20265 Safe Python script to detect Cisco FMC instances potentially vulnerable to CVE-2025-20265. Uses official FMC API to check version, supports single/multi-target scanning, and includes a harmless local PoC marker. Cisco FMC CVE-2025-20265 Vulnerability Checker Safe What it does: Uses...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2024-1208-and-CVE-2024-1210

CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API in LearnDash. Unauthenticated visitors can browse the quizzes and quiz questions without being enrolled in a connected course. Vulnerability: CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API CVSS: 5.3...

theHarvester

About theHarvester is a simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence OSINT gathering to help determine a domain's external threat landscape. The tool gathers names, emails,...

WordPress-CVE-2026-63030-Analysis

🛡️ CVE-2026-63030: Technical Analysis & Audit Comprehensive defensive teardown, threat analysis, and non-destructive verification guidelines. Summary • Matrix • Technical Deep Dive • Verification • Remediation 📑 Executive Summary !IMPORTANT Defensive Purpose Only: This repository provides purely...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC:...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

hoverfly

API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

api-scanner-docker

API Scanner - Self-Hosted Deployment API Scanner is an automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specifications and WSDL files. Prerequisites Docker Engine 20.10+ Docker Compose v2 Python 3.6+ for setup script 8 GB RAM minimum 16 G...

Cve-api

Parse & filter the latest CVEs from https://cve.mitre.org Docs Usage http://localhost:4000/cve?target=KEYWORD The year parameter is optional. http://localhost:4000/cve?target=KEYWORD&year=YEAR Examples http://localhost:4000/cve?target=ruby%20on%20rails...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2021-22986-Poc

CVE-2021-22986-Poc This is a Poc for BIGIP iControl unauth RCE POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...

wpUsersScan

wpUsersScan About wpUsersScan Enumerate the users list of the wordpress websites through the REST API / CVE-2017-5487,WordPress 4.7.1 - Username Enumeration Usage root@kitploit: $ python wpUsersScan.py URL How to install Clone Clone the repository with: root@kitploit: $ git clone...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

grafeo

ACT Platform is now called grafeo! Grafeo is a versatile platform to create custom data models, collect and share knowledge. It is a flexible, well-rounded solution that can be used for any purpose. Developed as part of the ACT research project, it remains at the core of ACT and powers the ACT...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC Full Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user Method: Privilege Escalation to Administrator and trigger RCE via REST API Endpoint: /v1/members/me endpoint. How to use Docker root@kitploit: git clo...

CVE-2023-2732

CVE-2023-2732 MStore API = 3.9.2 - Authentication Bypass https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-392-authentication-bypass Description root@kitploit: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to...