exploitcraft

exploitcraft Exploit development framework - vuln-binary buil...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...

[SECURITY] Fedora 43 Update: freeipa-4.13.3-2.fc43

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt JwtAuthenticator authentication bypass Full buildout: writeup, Java in-process PoC, Python token-forge CLI and library, tests. Summary CVE: CVE-2026-29000 CVSS 10, CWE-347 Affected: pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 when using JWE + signature config Issue: JWE-wrapped...

CVE-2026-41303

🔐 CVE-2026-41303: Authorization Bypass in OpenClaw Discord Bot -red?style=flat&logo=owasp Complete technical documentation on the authorization bypass vulnerability in OpenClaw 📋 Table of Contents General Description Technical Details Security Impact Proof of Concept Exploitation Methodology...

CVE-2026-39842

CVE-2026-39842: OpenRemote Expression Injection RCE in Rules Engine TL;DR Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with write:rules role to execute arbitrary code on the server with root privileges. CVSS Score : 10.0 Critical CVSS Vector...

exploit-CVE-2023-3460

title: "IT Security - CVE 2023-38408" Analysis and exploitation of CVE-2023-3460 CVE ID| CVSS Score| Discovered| Affected Plugin| Vulnerability Type ---|---|---|---|--- CVE-2023-3460| | 07/04/2023| Ultimate Member| Unauthorized Admin Access Table of Contents Introduction General vulnerability...

CVE-2026-31816-rshell

CVE-2026-31816 Reverse Shell Exploit Overview This tool exploits CVE-2026-31816 to establish a reverse shell connection on a target Budibase server. Attack Chain : Authentication Bypass → Upload DATASOURCE Plugin → Server-side Code Execution → Reverse Shell Requirements Python 3.6+ requests libra...

CVE-2026-30695

CVE-2026-30695 - XSS in Zucchetti Axess Summary A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+. The vulnerability is caused by improper sanitization of user-supplied...

CVE-2026-20841-PoC

CVE-2026-20841-PoC Proof of Concept for CVE-2026-20841 CVE-2026-20841 – Details CVE-2026-20841 is a vulnerability affecting Microsoft Notepad, where specially crafted input can trigger unintended command execution. The issue occurs due to improper handling of certain file content or execution...

marimo_CVE-2026-39987_RCE_PoC

CVE-2026-39987 - Marimo This script is ONLY for educational purposes and authorized testing. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for the misuse of this information. 📋 Description Marimo versions prior to 0.23.0 presen...

CVE-2025-25198

CVE-2024-25198 mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controll...

CVE-2026-0628-POC

CVE-2026-0628-POC Proof of Concept PoC for CVE-2026-0628, demonstrating script injection into privileged pages through the use of the tag in Google Chrome. This vulnerability, classified as CWE-862 Missing Authorization, allows a malicious extension to bypass security policies in versions prior t...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Oracle E-Business Suite Pre-Auth RCE Exploit A critical pre-authentication Remote Code Execution RCE flaw in Oracle E-Business Suite versions 12.2.3–12.2.14 allows attackers to gain full control over vulnerable servers via malicious HTTP requests — now actively exploited in the...

CVE-2026-31431

CVE-2026-31431 - Copy Fail PoC Educational Proof of Concept for CVE-2026-31431 , also known as Copy Fail , a Linux kernel local privilege escalation vulnerability involving the AFALG / algifaead cryptographic interface. !WARNING This repository is provided strictly for educational, defensive, and...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit A proof-of-concept checker and exploit for CVE-2026-30824 , a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication. Vulnerability Overview CVE-2026-30824 i...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

cve-2026-1731-scanner

CVE-2026-1731 — BeyondTrust RS/PRA Passive Vulnerability Scanner root@kitploit: ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ CVE-2026-1731 ║ ║ BeyondTrust RS/PRA Passive Vulnerability Scanner ║ ║ ║ ╠═══════════════════════════════════════════════════════════════╣ ║...

Pixnapping-Attack-on-Android

This article examines the evolution of security threats in the cryptocurrency storage space, focusing on modern methods for compromising private keys and seed phrases, which secure digital wallets. The modern cryptocurrency ecosystem faces a growing threat of cyberattacks aimed at compromising...