CVE-2026-53952

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...

CVE-2021-39409

CVE-2021-39409 Admin account registration is possible in Online Student Rate System v1.0, allowing a malicious actor to create an admin account and access the admin panel. Vulnerability root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664;...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2025-0282

PoC for CVE-2025-0282 Remote Unauthenticated Stack Buffer Overflow in Ivanti Products Overview This proof-of-concept demonstrates exploitation of CVE-2025-0282, a critical vulnerability affecting: Ivanti Connect Secure Ivanti Policy Secure Ivanti Neurons for ZTA gateways Based on watchTowr's...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2021-36394

CVE-2021-36394 Update table or Change password Admin: Custom Code $newpassword = "Accounttakedover123"; Then Execute: $ CVE2021-36394.php http://victim/pathtomoodle Execute function Custom Code $function = "header"; $param = "Hacked: by0d0ff9"; Then Execute: $ CVE2021-36394RCE.php...

CVE-2020-25078

CVE-2020-25078 Instructions instructions Place the attack URLs in the same directory as ip.txt The attack IP is placed in the same directory as ip.txt Terminal log root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt https://xxx.xxx.xxx.xxx:3128...

harbor-give-me-admin

Harbor Admin Account Creation Vulnerability Detection Tool 0x00 Overview In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "hasadminrole": true, an administrator...

CVE-2019-19654

CVE-2019-19654 Chevereto denial of service - = 3.13.5 Core in the /dashboard/bulk tool. An attacker with an admin account can insert any path. The bulk importer will remove any file and folder it has access to. Basically you can make the website self-destruct. Add job to "import" /var/www/html...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in the WordPress Plugin: Opal Estate Pro = 1.7.5, which allows creating an administrator account without authentication. ⚠️ Disclaime...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc local file inclusion to remote code execution of Node.js code on the server, discovered by @yuriisanin Features Custom Node.js code to execute server-side using --payload-file Cleanup after exploit Requirements An admin account on the PwnDoc instance Usage...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended for image uploads to RCE. CVE-2020-24597 Directory traversal in commedia to RCE Two CVEs are the same. PoC Full Affected version: Joomla core =3.9.24 User requirement: Admin account Not Superadmin Gain access: Create superadmin, then...

CVE-2023-22518

CVE-2023-22518 Checker for CVE-2023-22518 and CVE-2023-22515 critical vulnerabilities in Confluence. Description This script is designed to check for and exploit vulnerabilities in Atlassian Confluence instances. It checks for the vulnerability CVE-2023-22518, and exploits the vulnerability...

url-tracker

URL Tracker v0.5.0 URL Tracker is a robust and scalable web application designed to monitor and track URLs, log changes, and provide detailed insights into the status and behavior of various web resources. Built on top of Sails.js, this application is perfect for tracking URLs for uptime, content...

CVE-2026-8732-POC

CVE-2026-8732 - WordPress WP Google Map Pro Mass Scanner & Auto Admin Creator 📌 Description This tool exploits CVE-2026-8732 , a vulnerability in the WP Google Map Pro plugin for WordPress. The vulnerability allows an unauthenticated attacker to obtain a valid wpmptoken via an AJAX endpoint...

CVE-2023-22515-NSE

CVE-2023-22515-NSE This repository provides a tool to check for the presence of the CVE-2023-22515 vulnerability in Atlassian Confluence Server using the Nmap Scripting Engine NSE. Overview of CVE-2023-22515 CVE-2023-22515 is a critical vulnerability in Atlassian Confluence Server that allows...

CVE-2023-3460

CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...

CVE-2023-6329

CVE-2023-6329 — Control iD iDSecure Authentication Bypass A Python proof-of-concept exploit for CVE-2023-6329 , an improper access control vulnerability in Control iD iDSecure versions 4.7.43.0 and below. The flaw allows an unauthenticated remote attacker to reconstruct valid login credentials by...

CVE-2025-6934-PoC

🔓 CVE-2025-6934 Exploit Tool Unauthenticated Administrator Account Creation in WordPress Plugin Opal Estate Pro Created and developed fully by mejbankadir SMH tech and Mejban HackSheild Under NexoAmicus 📋 Description CVE-2025-6934 is a critical vulnerability in the WordPress Opal Estate Pro plugi...