monitorr-exploit-toolkit

Monitorr exploit toolkit RCE via unsecure file upload PHP reverse shell, webshell, etc. Administrator account creation via Authorization bypass Technical information leakage : Monitorr version, PHP version, System version & kernel, PHP config, etc. Exploit for CVE-2020-28872 and CVE-2020-28871...

CVE-2023-7028

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you...

CVE-2019-16097

CVE-2019-16097 This program is only for security research, do not use it illegally! Vulnerability Impact Attackers can create an administrator account, upload malicious images, and infect clients using the repository. Affected Component Harbor Affected Versions 1.7.0-1.8.2 Remediation Upgrade to...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2026-14378

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

EUVD-2026-91165

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378

The DevKit Pro plugin for WordPress (versions ≤ 2.3.0 ) is vulnerable to an Authentication Bypass leading to full Administrator Account Takeover . The root cause is a flawed user-switch "revert" flow where the revert_switch handler trusts the attacker-controlled original_user_id cookie to identif...

The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation

The Opal Estate Pro plugin ≤ 1.7.5 is vulnerable to privilege escalation. Due to missing role restrictions in the onregisteruser function, users can register with any role. This allows unauthenticated attackers to create administrator accounts. id: CVE-2025-6934 info: name: The Opal Estate Pro –...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

Netgear-WN604 downloadFile.php - Information Disclosure

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

PT-2026-104073

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert switch handler trusting the attacker-controlled original user id cookie as the privileged identity: verify non...

Exploit-CVE-2023-22515

Exploit CVE-2023-22515 A simple basch script exploit for CVE-2023-22515. Information Confluence Data Center and Server instances have a Broken Access Control Vulnerability CVE-2023-22515, allowing attackers to create unauthorized Confluence administrator accounts and access Confluence instances...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core Plugin Plugin OPTIONS Example: python CVE-2025-49388.py -u http://127.0.0.1/wordpress Main Options: Option| Description| Examp...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...