WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...

CVE-2025-6934

CVE-2025-6934 unauthenticated privilege escalation in opal estate pro Description CVE-2025-6934 is a critical vulnerability in the Opal Estate Pro WordPress plugin ≤ v1.7.5. This bug allows an unauthenticated attacker to create a new administrator account by sending a crafted request to:...

url-tracker

URL Tracker v0.5.0 URL Tracker is a robust and scalable web application designed to monitor and track URLs, log changes, and provide detailed insights into the status and behavior of various web resources. Built on top of Sails.js, this application is perfect for tracking URLs for uptime, content...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2023-42793

CVE-2023-42793 - TeamCity Admin Account Creation lead to RCE use exploit.py first to creat administrator account for you and then use rce.py to execute commands on the target, and for reverse shell check this exploit script Description This script exploits CVE-2023-42793 to create an admin accoun...

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Author: Subhodeep Baroi CVE-2024-40119: CSRF Vulnerability in Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 Description CVE-2024-40119 is a Cross-Site Request Forgery CSRF vulnerability in the Nepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 firmware v2.0.1. This...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2025-0282

PoC for CVE-2025-0282 Remote Unauthenticated Stack Buffer Overflow in Ivanti Products Overview This proof-of-concept demonstrates exploitation of CVE-2025-0282, a critical vulnerability affecting: Ivanti Connect Secure Ivanti Policy Secure Ivanti Neurons for ZTA gateways Based on watchTowr's...

CVE-2025-31161

CVE-2025-31161 Proof of Concept for CVE-2025-31161 / CVE-2025-2825 This POC will exploit the authbypass vulnerability to create a new user account with Admin level permissions. The Auth Bypass requires the username targetuser of an existing user on the CrushFTP server. The default is set to...

CVE-2023-22515-Scan

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...

CVE-2025-14340

XSS to Admin account takeover CVE-2025-14340 A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution of attacker-controlled JavaScript leading to admin account take over. Because of: 1. The panel uses HTTP Basic Auth credentials are sent automatically by t...

CVE-2024-24401

Vulnerability Report CVE Disovered DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that the target system is...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

CVE-2023-22515-Scan.

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended for image uploads to RCE. CVE-2020-24597 Directory traversal in commedia to RCE Two CVEs are the same. PoC Full Affected version: Joomla core =3.9.24 User requirement: Admin account Not Superadmin Gain access: Create superadmin, then...

CVE-2024-27956

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released CVE-2024-27956. WordPress Admin Account Creation and Reverse Shell cve-2024-27956 Usage- sudo python3 cve.py...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress Plugin Unauthenticated Admin Access Proof-of-Concept PoC demonstrating CVE-2026-23550 - critical unauthenticated admin account takeover in Modular DS WordPress plugin versions ≤2.5.1. Actively exploited in the wild. Attack Summary : Flawed...