HikPwn

HikPwn HikPwn, a simple scanner for Hikvision devices with basic vulnerability scanning capabilities written in Python 3.8. This project was born out of curiosity while I was capturing and watching network traffic generated by some Hikvision's software and devices. Setup instructions:...

CVE-2026-86709

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86710

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86710

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Wonder CMS v.3.2.0 至 v.3.4.2 版本中存在跨站脚本（XSS）漏洞，允许远程攻击者通过上传到 installModule 组件的恶意脚本执行任意代码。 仅用于教育目的 需要知道 loginURL、拥有管理员访问权限，或能够诱使管理员点击 XSS 链接。 1. 克隆仓库 root@kitploit: git clone https://github.com/thefizzyfish/CVE-2023-41425-wonderCMSRCE.git 2. 运行 root@kitploit: usage:...

open-sammy

SAMMY Código Abierto v2 Este repositorio aloja la versión de código abierto de SAMMY, la herramienta OWASP SAMM. https://owasp.org/www-project-open-sammy/ Licencia Este proyecto está licenciado bajo la Licencia Creative Commons Attribution-ShareAlike 4.0 International. Consulta el archivo LICENSE...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML 认证绕过利用框架工具包 Oracle WebLogic Server — SAML 认证绕过 → 管理员接管 利用框架及批量扫描器 仅供授权的安全测试使用。 ⚖️ 法律免责声明与负责任使用 本工具仅供教育和授权的渗透测试之用。 作者和贡献者不对因使用本软件而导致的任何误用或损害负责。用户独自负责确保在测试前已获得目标所有者的明确书面许可。未经授权访问计算机系统违反《计算机欺诈和滥用法》CFAA 及全球类似法律。 使用本软件即表示您同意： 仅用于您拥有或已获明确许可进行测试的系统。 遵守所有适用的地方、州和联邦法律。...

WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. id: CVE-2021-24215...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

WP Content Permission <= 1.2 - Cross-Site Scripting

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

ReCrystallize Server - Authentication Bypass

This vulnerability allows an attacker to bypass authentication in the ReCrystallize Server application by manipulating the 'AdminUsername' cookie. This gives the attacker administrative access to the application's functionality, even when the default password has been changed. id: CVE-2024-26331...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

OpenBullet2 <= 0.3.2 - Authentication Bypass

OpenBullet2 = 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header. id: CVE-2026-25555 info: name: OpenBullet2 = 0.3.2 -...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...