cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. replace zbxsignedsession to cookie 2. sign in with Single Sign-On SAML author: @random-robbie、@jweny and @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

CVE-2024-6043

CVE-2024-6043 CVE-2024-6043 CVE-2024-6043 Overview This Python tool exploits the CVE-2024-6043 vulnerability, which affects the SourceCodester Best House Rental Management System 1.0. The vulnerability allows remote attackers to perform SQL Injection via the adminclass.php file, specifically...

CVE-2024-0012

CVE-2024-0012 CVE-2024-0012 an authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit...

CVE-2025-24054_CVE-2025-24071-PoC

CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. ⚠️ This is for educational and research purposes only. Do not use this on production...

cpanel-cve-2026-41940-fix

cpanel-cve-2026-41940-fix One-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940 and the nuclear.x86 botnet campaign. What this is On 28 April 2026 , cPanel disclosed a pre-authentication authentication-bypass vulnerability CVE-2026-41940, CVSS 9.8 affecting all...

CVE-2021-43798

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All credits go to j0v and his tweet https://twitter.com/j0v0x0/status/1466845212626542607 Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. In good faith, I've held back releasing...

CVE-2026-24061

text feat3 1change feat2 1feat test CVE-2026-24061 GNU Inetutils telnetd Remote Authentication Bypass Seriously, telnet in 2026? Come on guys, it's time to move on. SSH exists since 1995. 🤦 Description A critical authentication bypass vulnerability in GNU Inetutils telnetd affecting versions 1.9....

auth-header-trust-rules

auth-header-trust-rules A small Semgrep rule pack that flags code making authentication, authorization, or trust decisions based on HTTP request headers an attacker controls. The canonical example of the vulnerability class is CVE-2025-29927: Next.js trusted the x-middleware-subrequest header to...

poc-cve-2025-55182

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ WARNING: This repository is for educational and security research purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Overview This repository contains a proof-of-concept demonstration of...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — Unauthenticated Privilege Escalation 8-Phase Exploitation Automation | Multiprocessing + Asyncio | Verified Admin Creation 🎯 About the Vulnerability The WordPress plugin WP Maps Pro version ≤ 6.1.0 has an unauthenticated privilege escalation vulnerability. An...

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

CVE-2025-31161

CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit 📌 Description This Python exploit targets CrushFTP servers vulnerable to CVE-2025-31161. The vulnerability allows unauthenticated user account creation by sending a crafted XML payload to the WebInterface, potentially resulting...

web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install python3 -m pip install -r requirements.txt ⏩ Usage $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /| /|| / / / /...

libssh-scanner

libssh scanner Introduction This is a python based script to identify hosts vulnerable to CVE-2018-10933. Libssh scanner has two modes: passive banner grabbing and aggressive bypass auth to validate vulnerability's existence. By default, libssh scanner uses passive mode but supply the -a argument...

CVE-2026-24061---telnetd

CVE-2026-24061 – telnetd 🔥 Description CVE-2026-24061 is a critical vulnerability affecting certain implementations of telnetd , allowing an authentication bypass and the obtainment of a remote root shell without valid credentials. This repository provides a Proof of Concept PoC for detecting...

cpanelCVE-2026-41940

🔴 cPanelCVE CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS 10.0 Critical · Confirmed In‑The‑Wild · Auto Root Login 📖 Overview cPanelCVE is a proof‑of‑concept exploit for CVE-2026-41940, a critical session‑file CRLF injection vulnerability in cPanel & WHM that allows complete root...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM Cross-Tenant Signup Bypass Status 01.12.2025: This vulnerability is still live and exploitable. Microsoft has not patched this issue and considers it "by design." Security Advisory GHSA-vcwf-73jp-r7mv CVE-2025-66390 Summary A security vulnerability in Azure API Management APIM Develope...

CVE-2024-4358

Telerik Report Server Authentication Bypass - CVE-2024-4358 Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicabl...

authz0

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers...

CVE-2026-31816-rshell

CVE-2026-31816 Reverse Shell Exploit Overview This tool exploits CVE-2026-31816 to establish a reverse shell connection on a target Budibase server. Attack Chain : Authentication Bypass → Upload DATASOURCE Plugin → Server-side Code Execution → Reverse Shell Requirements Python 3.6+ requests libra...