WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...

WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Forminator versions = 1.57.2...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Обход аутентификации при доступе к ресурсам между организациями в Pangolin Proof-of-concept для CVE-2026-72001 — уязвимости нарушенной авторизации на уровне объектов в Pangolin 1.22.0, которая позволяет владельцу одной share-ссылки на ресурс создать действительную сессию ресурса...

socialhunter

socialhunter !IMPORTANT Cet outil ne fonctionne plus et nous ne pourrons pas le réparer car il est devenu difficile de contourner les protections des réseaux sociaux. Parcourt l'URL donnée et trouve les liens cassés vers les réseaux sociaux qui peuvent être détournés. Les liens sociaux cassés...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2025-24000-exploit

CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...

vRealizeLogInsightRCE

VMSA-2023-0001 POC for VMSA-2023-0001 affecting VMware vRealize Log Insight which includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control Vulnerability CVE-2022-31704 VMware vRealize Log Insight...

BrokenHill

!\ Broken Hill logo \https://assets.kitploit.com/production/public/readmes/44608/c14154675c6f33f5c3887887afcdb39351c82f269ee2772cf31847106a20a871.jpg Broken Hill Broken Hill is a productionized, ready-to-use automated attack tool that generates crafted prompts to bypass restrictions in large...

cve-2026-86060

CVE-2026-86060 — Повышение привилегий до полного административного контроля в MikroTik RouterOS SSH до аутентификации Поле| Значение ---|--- CVE| CVE-2026-86060 Продукт| MikroTik RouterOS служба SSH Уязвимые версии| RouterOS 6.x и 7.0.0 – 7.23.3 включительно Исправленные версии| RouterOS 7.23.4 и...

CVE-2026-73318

CVE-2026-73318: Missing authorization on force-agreement actions XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController...

CVE-2022-42889-Text4Shell-POC

Broken Link Hijack Poc By: Alfaz Download CVE-2022-42889-Text4Shell-POC Click Here...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — WooCommerce Wholesale Prices Authenticated Privilege Escalation Lab Overview This project is a local Docker lab for analyzing and reproducing the behavior of CVE-2026-27541 in the WooCommerce Wholesale Prices / Wholesale Suite plugin by comparing vulnerable and patched builds...

CVE-2026-52200

UZ801 / ES-U3TS MifiService Broken Access Control Security advisory and technical notes for a broken access control issue in the embedded web management API exposed by MifiService.apk on the OEM / white-label UZ801v2.1 4G LTE mobile Wi-Fi platform, also observed marketed as ES-U3TS. This reposito...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...

CVE-2025-49901

CVE-2025-49901 WordPress Simple Link Directory Plugin 14.8.1 is vulnerable to a high priority Broken Authentication ╔═══════════════════════════════════════════════════════════════════╗ ║ CVE-2025-49901 · Simple Link Directory · qc-opd ║ ║ Authentication Bypass → Password Reset → RCE ║...