Lucene search
+L

8425 matches found

Kitploit
Kitploit
added 2026/09/22 1:32 p.m.12 views

CVE-2023-7028

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and should be used by cybersecurity professionals to identify possible vulnerable GitLab servers. Description CVE-2023-7028 - Account Takeover via Password Reset without user interactions in GitLab Community Edition and Enterprise Edition...

10CVSS8.3AI score0.94647EPSS
SaveExploits16
Kitploit
Kitploit
added 2026/09/22 1:30 p.m.9 views

CVE-2024-5009

CVE-2024-5009 PoC for Progress WhatsUp Gold SetAdminPassword Privilege Escalation CVE-2024-5009 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ Usage root@kitploit: python3 CVE-2024-5009....

8.4CVSS8AI score0.1742EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/22 1:02 p.m.7 views

zerologon

ZeroLogon 漏洞利用脚本 利用代码基于 https://www.secura.com/blog/zero-logon 和 https://github.com/SecuraBV/CVE-2020-1472。原始研究和扫描工具由 Secura 完成,RiskSense Inc. 进行了修改。 要利用此漏洞,请清除先前安装的任何 Impacket 版本,并从 https://github.com/SecureAuthCorp/impacket/commit/b867b21 或更新版本安装 Impacket。然后执行: root@kitploit: python3 setemptypw...

10CVSS8AI score0.99389EPSS
SaveExploits76References2
Kitploit
Kitploit
added 2026/09/22 12:21 p.m.12 views

CVE-2021-27651

Summary An attacker can bypass all stages of the password reset flow and reset any user's account on Pega infinity. This is done by 1 initiating the password reset flow and typing in the victim email, then 2 forcing the HTTP POST request to update the password through. An attacker could login usi...

9.8CVSS8.5AI score0.53841EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 10:30 a.m.13 views

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ Unauthenticated Privilege Escalation via Arbitrary Password Reset ☆ === Beelze === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-11387 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type| Missing Authenticatio...

9.8CVSS5.9AI score0.02208EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 9:30 a.m.13 views

CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

9.8CVSS8.2AI score0.90339EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/22 9:20 a.m.10 views

CVE-2025-4606

CVE-2025-4606- WordPress Sala Theme = 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover 🔥 Vulnerability Summary The WordPress theme Sala versions = 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attacke...

9.8CVSS8.3AI score0.00581EPSS
SaveExploits1
CVE
CVE
added 2026/09/22 8:57 a.m.11 views

CVE-2026-93556

Tankuam Places by Kompini is affected by an Insecure Direct Object Reference (IDOR) in the /password/guardarClau/recover endpoint. The endpoint accepts a usuariId parameter to specify which account's password to change, but the JWT token used in the recovery process is not validated against that ...

9.3CVSS5.8AI score0.00305EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/22 8:07 a.m.11 views

token-reverser

Token Reverser 用于破解安全令牌的单词列表生成器。 安装 root@kitploit: $ git clone https://github.com/dariusztytko/token-reverser.git 示例用例 1. 你正在测试重置密码功能 2. 重置密码令牌已发送到你的邮箱(例如 582431d4c7b57cb4a3570041ffeb7e10) 3. 你推测它是你在注册时提供的数据的MD5哈希值 4. 注册时你输入了以下数据: First name: Foo Last name: Bar Email: [email protected] Birth...

6.2AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/22 7:33 a.m.9 views

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

8.8CVSS5.9AI score0.00293EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 7:25 a.m.10 views

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

9.8CVSS6.2AI score0.01278EPSS
SaveExploits7References1
Kitploit
Kitploit
added 2026/09/22 6:35 a.m.11 views

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

9.8CVSS6.2AI score0.01383EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/22 4:08 a.m.9 views

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

9.8CVSS5.9AI score0.02948EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.239 views

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. id: CVE-2019-18818 info: name: strapi CMS 3.0.0-beta.17.5 - Admin Password Reset...

9.8CVSS8.2AI score0.97639EPSS
SaveExploits13References5
NVD
NVD
added 2026/09/21 10:16 p.m.7 views

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

7.4CVSS0.00313EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/21 10:06 p.m.8 views

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...

5.9CVSS7AI score0.26699EPSS
SaveExploits7
Kitploit
Kitploit
added 2026/09/21 9:44 p.m.10 views

CVE-2024-10508

Unauthenticated Privilege Escalation via Password Recovery on RegistrationMagic = 6.0.2.6 Disclaimer : This information is provided for educational purposes only. This document aims to raise awareness of security vulnerabilities and should not be used for any unauthorized or malicious activities...

9.8CVSS7.7AI score0.01518EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/21 9:43 p.m.9 views

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

7.5CVSS8.1AI score0.17212EPSS
SaveExploits5
CVE
CVE
added 2026/09/21 9:21 p.m.16 views

CVE-2026-93340

Gladys Assistant before version 5.1.0 is affected by a password reset link poisoning vulnerability in the forgot_password endpoint. The root cause is the server's acceptance of a client-supplied origin parameter without validation , allowing an unauthenticated remote attacker to craft a request w...

7.4CVSS5.9AI score0.00313EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/21 7:57 p.m.10 views

CVE-2021-22911

CVE-2021-22911 Modifed ver of the original exploit to save some times on password reseting for unprivileged user The script assumes that you can register the account or already know credentials of unprivileged users. Change the password to the valid password on line: 63,73,96. Original exploit:...

9.8CVSS8.2AI score0.95242EPSS
SaveExploits16
Rows per page
Query Builder