CVE-2017-8295

CVE-2017-8295 Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lead to an attacker gaining unauthorised access to a victim's WordPress account...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

MadeYouReset_Tester

MadeYouReset Checker A lightweight Python script to detect whether a web server is potentially vulnerable to the MadeYouReset HTTP/2 denial-of-service vulnerability — tracked as CVE-2025-8671 CVSS 7.5 High. Background MadeYouReset is an HTTP/2 DoS vulnerability disclosed in August 2025 by...

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

CVE-2024-9464

CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Proof of concept to exploit CVE-2024-9464 on vulnerable devices. This script chains the admin reset of CVE-2024-5910 to achieve "unauthenticated" arbitrary command execution. Blog Post Root cause and indicators of compromise here...

creak

creak Performs some of the most famous MITM attack on target addresses located in a local network. Among these, deny navigation and download capabilities of a target host in the local network performing an ARP poison attack and sending reset TCP packets to every request made to the router. Born a...

CVE-2024-55591-POC

--port 443 --ssl Then use the prompt: root@kitploit: FortiOS get system status FortiOS exit...

gattacker

A Node.js package for BLE Bluetooth Low Energy Man-in-the-Middle & more. Prerequisites see: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Install root@kitploit: npm install gattacker Usage Configure Running both components Set up variables in config.env:...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for WordPress wp-jobhunt plugin wp-jobhunt plugin is a plugin used with JobCareer theme: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 see changelog at the bottom Python exploit for CVE-2018-19487 AJ...

CVE-2023-7028

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you...

CVE-2022-1597

CVE-2022-1597 The plugin, used as a companion for the Discy and Himer themes, does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks Affected Plugins: WPQA history.pushState'', '', '/' Nuclei Template:...

CVE-2021-27651

CVE-2021-27651 Pega Infinity Password Reset Video Follow Youtube Twitter Telegram Vulnmachines.com...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover 📌 Themes Information Plugin : Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Vulnerable Version : = 5.6.67 CVE : CVE-2025-4322 Severity : 9.8...

cve-2023-42820

cve-2023-42820 JumpServer Affected Versions v2.24 - v3.6.4 Impact With knowledge of the email associated with the JumpServer admin user account default: admin/[email protected], it is possible to reset the admin password through this vulnerability, and by combining it with JumpServer's...

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...

CVE-2022-24181

CVE-2022-24181 and CVE-2022-26616. both are probably same Open-journal-system-Vulnerability XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: 1. Go to this site: https://who's-using-ojs-software.com 2. And capture this request in burp , and send to...

CVE-2021-22911

CVE-2021-22911 元のエクスプロイトの修正版で、非特権ユーザーのパスワードリセットの時間を節約します。 このスクリプトは、アカウントを登録できるか、非特権ユーザーの認証情報をすでに知っていることを前提としています。 63、73、96行目で有効なパスワードに変更してください。 元のエクスプロイト: https://www.exploit-db.com/exploits/49960...

ZeroLogon-PoC-DC-Pwn

Zerologon CVE-2020-1472 Overview This project is an implementation of the Zerologon vulnerability CVE-2020-1472 , one of the most critical Active Directory security vulnerabilities. This vulnerability allows an unauthenticated attacker to compromise the entire Active Directory domain by resetting...

exploit-CVE-2024-25723

Exploit for CVE-2024-25723 This repository is dedicated to addressing CVE-2024-25723, a critical security vulnerability in ZenML, with an educational Proof of Concept PoC provided to illustrate the issue and encourage prompt mitigation. The PoC demonstrates how an unauthorized user could...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 The vulnerability was caused by a bug in how GitLab handled email verification during password reset. An attacker could provide two email addresses during a password reset request, and the reset code would be sent to both addresses. This...