UhOh365

UhOh365 A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerabilit...

lxancephisher

A beginners friendly, Automated phishing tool with 30+ templates. Disclaimer Any actions and or activities related tolxancephisher is solely your responsibility. The misuse of this toolkit can result in criminal charges brought against the persons in question. The contributors will not be held...

EUVD-2026-69887

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-82883

CVE-2026-82883 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login With Ajax by Marcus , affecting versions from n/a through 4.5.1 . The root cause is improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts th...

mysql_dos

This tool crashes vulnerable MySQL servers using CVE-2017-3599, a remote integer overflow when parsing login credentials. It can be downloaded here you will need to run it from the command line Usage: mysqldos target port...

TYPO3-v7.6.15-Unencrypted-Login-Request

TYPO3-v7.6.15-Unencrypted-Login-Request TYPO3 v7.6.15 Unencrypted Login Request Assigned CVE Number: CVE-2017-6370...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE 開示: CVE-2026-29861 — PHP-MYSQL-User-Login-System における SQL インジェクション 開示日: 2026年4月10日 CVE ID: CVE-2026-29861 深刻度: CRITICAL CVSS 9.8 🧩 概要 PHP-MYSQL-User-Login-System v1.0 の login.php エンドポイントに、重大な SQL インジェクションの脆弱性が存在します。このアプリケーションは、サニタイズされていないユーザー入力を SQL...

CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentials Dump Author : Javier Carabantes Affected Software : XOne Web Monitor Software : https://xone.es/ Affected Version : 02.10.2024.530 framework 1.0.4.9 Description An unauthenticated SQL injection vulnerability has been discovered in t...

CVE-2022-31007-Python-POC

Python automation of the following write up on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0. Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electron...

CVE-2024-26521

CVE-2024-26521 CE-Phoenix-v1.0.8.20 Html Injection vulnearbility Login Page As we can see there is a login page that anyone can understand there is a HTML injection vulnerability are there in this application. Basically in this application all php save in this location as you can see the image...

CVE-2026-81583

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-81583

The My Login WordPress plugin (versions 7.0 through 7.1.15 ) fails to enforce the network's registration setting when processing site signups on multisite installations. This allows users with a subscriber account—and, on some networks, unauthenticated users—to create new sites and be granted adm...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

EUVD-2026-69857

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

evilginx2

Evilginx 3.0 Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server...

wp-def

wp-def Wordpress Default User + Pass Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Vulnerabilidad de ejecución remota de código no autenticada en Wing FTP Server = 7.4.3. Un byte NULL inyectado en el parámetro username durante el inicio de sesión provoca que se escriba código Lua en el archivo de sesión. Cuando se accede a /dir.html con la cooki...

cve-2020-1764-poc

CVE-2020-1764 PoC Auth bypass PoC for Kiali 0.4.0 to 1.15.0 using login auth strategy Security Bulletin check version: curl 'http:///api check auth strategy: curl 'http:///api/auth/info' go run ./poc.go curl 'http:///api/status' -H "Authorization: Bearer $JWT"...

CVE-2020-5902

Readme F5 BIG-IP arbitrary file read + remote command execution RCE root@kitploit: +-------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-5902 F5 BIG-IP Read File + RCE +...