CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Exploit for CVE-2022-22845 - Unauthenticated Admin Takeover On QXIP SIPCAPTURE Homer-App up to 1.4.27 Discovery: Omri Baso & Fabien Aunay Exploit Author: Omri Baso...

CVE-2024-33911

The School Management 10.3.4 - Post-Authenticated SQL Injection Exploit Title: The School Management 10.3.4 - Post-Authenticated SQL Injection Date: 29 April, 2024 Exploit Author: Ivan Spiridonov xbz0n Vendor Homepage: https://theschool-management.com Version: 10.3.4 Tested on: Ubuntu 22.04 CVE:...

CVE-2023-51119

CVE-2023-51119 Improper Access Control on D-Link DIR-605L router Exploitation explanation: Due to an incorrect access control, a takeover can be done over the admin account without any kind of authentication sending a request under special circumstances only needs a legitimate admin to be logged ...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector Unauthenticated Remote Code Execution RCE Description Product : MCPJam Inspector Affected versions : ≤ 1.4.2 Fixed version : 1.4.3 Type : Unauthenticated Remote Code Execution RCE Attack vector : Network Authentication required : No User interaction required : No...

CVE-2025-65427

CVE-2025-65427: Authentication Rate Limiting Issue in Dbit N300 T1 Pro CVE ID: CVE-2025-65427 Date: 2025-12-16 Discoverer: Kirubel Product: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Firmware Version: V1.0.0 Description An issue was discovered in the Dbit N300 T1 Pro Easy Setup Wireless...

CVE-2024-10924

CVE-2024-10924 - Authentication Bypass in Really Simple Security OVERVIEW This project demonstrates the exploitation and mitigation of CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress "Really Simple Security" plugin. STEP 1: ENVIRONMENT SETUP Start the vulnerable...

CVE-2025-11001

Usage: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited...

CVE-2023-29983

Exploit Title: Stored Cross Site Scripting Google Dork: Date: 27.04.2023 Exploit Author: Lucas Noki 0xPrototype Vendor Homepage: https://github.com/vogtmh Software Link: https://github.com/vogtmh/cmaps Version: 8.0 Tested on: Mac, Windows, Linux CVE : CVE-2023-29983 Description: The vulnerability...

Monitorizer

Monitorizer The Ultimate Subdomain Monitoring Framework Installation ❗ Disclaimer --- Admin users are able to execute code on the local server make sure to change the default password at otherwise use it at your own risk Using docker $ curl...

CVE-2023-22518

CVE-2023-22518 Checker for CVE-2023-22518 and CVE-2023-22515 critical vulnerabilities in Confluence. Description This script is designed to check for and exploit vulnerabilities in Atlassian Confluence instances. It checks for the vulnerability CVE-2023-22518, and exploits the vulnerability...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2025-52357

CVE-2025-52357 : Security Advisory: XSS in FD602GW-DX-R410 Router Admin Console Proof of Concept and Security Advisory for Reflected XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console firmware V2.2.14. Includes details, impact, and mitigation guidance. Overview A Cross-Site...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

CVE-2025-63820

CVE-2025-63820 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Vulnerability details When logging into the control panel, the username and password are sent in plain-text:...

CVE-2026-28767

CVE-2026-28767: Missing Authentication on Administrative Notifications Endpoint Advisory Field| Value ---|--- CVE| CVE-2026-28767 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-306 Missing Authentication for Critical Function...

CVE-2023-32315

CVE-2023-32315 Openfire's administrative console the Admin Console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environmentin an already configured Openfi...

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb Exploitation Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without permission. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, tw...

CVE-2026-5118

Divi Form Builder ⚠️ WARNING: This tool is for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test. More Disclaimer You can see the disclaimer on the cover of...

CVE-2023-39144

CVE-2023-39144 Background I discovered this vulnerability in May of 2023. Element55 produces software for law offices to track time. This software pulls information from various locations, such as Exchange, SQL, and Shoretel. Timeline May 24, 2023 - Reported vulnerability to Element 55 May 25, 20...