noPac

About Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user Changed from sam-the-admin. Usage SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate to DC. options: -h, --help show this hel...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

CVE-2025-30911

Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---Critical-Authentication-Bypass- CVE-2025-41646 - Critical Authentication bypass 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC A critical authentication bypass vulnerability CVE-2025-41646 in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as admin without val...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

CVE-2022-21661

WordPress CVE-2022-21661 Scanner Usage python wordpressscanner.py -H -p -ssl -proxy -path Help WordPress Scanner for CVE-2022-21661 options: -h, --help show this help message and exit -H HOST, --host HOST Host or IP address -p PORT, --port PORT Port number -ssl, --sslsupport Support SSL/TLS -prox...

smartermail-CVE-2026-23760-poc

SmarterMail-CVE-2026-23760-poc A proof-of-concept exploiting an authentication bypass via password reset API for the SmaretMail system administrator account. Vulnerability The vulnerability exists due to an authentication bypass vulnerability in the password reset API. The force-reset-password...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x built for htb-nexus 🛠 Quick start and Usage 1. Clone the repository: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.gi...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556

The HappyForms WordPress plugin (versions before 1.26.15 ) is vulnerable to unauthenticated HTML injection . The root cause is the failure to sanitize or escape a user-controlled referral value (client_referer) before embedding it into form notification emails. This allows unauthenticated attacke...

WordPress HappyForms plugin < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email vulnerability

Unauthenticated HTML Injection in Admin Notification Email vulnerability discovered by minaruzzaman shovon in WordPress Plugin Happyforms versions 1.26.15...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

Admin-Scanner

Admin-Scanner Website Admin Panel Finder How To Install? Linux/pc sudo apt install python3 sudo apt install python3-pip sudo apt install git git clone https://github.com/alienwhatever/Admin-Scanner.git cd Admin-Scanner How to Install? Termux/Android pkg update && pkg upgrade pkg install python3 p...

wsuks

wsuks Automating the WSUS Attack Gaining local administrative access to a domain-joined Windows machine is typically the first step during a penetration test. In many cases, the Windows Server Update Service WSUS is configured to deploy updates to clients over the local network using HTTP. Withou...

CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended for image uploads to RCE. CVE-2020-24597 Directory traversal in commedia to RCE Two CVEs are the same. PoC Full Affected version: Joomla core =3.9.24 User requirement: Admin account Not Superadmin Gain access: Create superadmin, then...

Exploit-LPE-CVE-2026-21721

💥 CVE-2026-21721 Exploit Wrote an exploit for CVE-2026-21721 and tested it on a test bench. 🎯 What's inside A combat privilege escalator: logs in, reads permissions, writes Admin permission=4 on all dashboards. A valid account with Editor rights is required for exploitation. 🧪 Tested on a test...

ScreenConnect-AuthBypass-RCE

How to use I'm using Python3.9 pip install requests python check.py python batchAdduser.py python ScreenConnect-AuthBypass-RCE.py -h usage: ScreenConnect-AuthBypass-RCE.py -h -u USERNAME -p PASSWORD -t TARGET -d DOMAIN --proxy PROXY CVE-2024-1708 && CVE-2024-1709 -- RCE!!! optional arguments: -h,...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 A remote code execution RCE attack allow an attacker run code on a computer. The ability to execute code could lead to deploying additional malware or stealing sensitive data or even harm the server. The remote code execution was discover in Qloapps version 1.6.0.0 whil...