Lucene search
+L

8472 matches found

Kitploit
Kitploit
added 2026/09/22 5:12 p.m.7 views

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover via Weak Password Reset Validation via 'resetuserid' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'resetactivationcode' Leading to Account Takeover CVE-2026-12417 & CVE-2026-12416 — Mass...

9.8CVSS5.9AI score0.0082EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 3:53 p.m.11 views

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Automated Exploit - Usage Guide What This Script Does Automates the full account takeover chain in 4 HTTP request groups: 1. Vulnerability Verification - Confirms the target is vulnerable 2. Email Enumeration - Extracts admin email via boolean oracle 500 requests 3. Password Reset...

9.2CVSS6AI score0.01916EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/22 3:32 p.m.13 views

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

9.1CVSS8.3AI score0.03177EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/22 3:31 p.m.10 views

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

9.1CVSS8.4AI score0.03177EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/22 1:32 p.m.12 views

CVE-2023-7028

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and should be used by cybersecurity professionals to identify possible vulnerable GitLab servers. Description CVE-2023-7028 - Account Takeover via Password Reset without user interactions in GitLab Community Edition and Enterprise Edition...

10CVSS8.3AI score0.94647EPSS
SaveExploits16
Kitploit
Kitploit
added 2026/09/22 1:02 p.m.7 views

zerologon

ZeroLogon 漏洞利用脚本 利用代码基于 https://www.secura.com/blog/zero-logon 和 https://github.com/SecuraBV/CVE-2020-1472。原始研究和扫描工具由 Secura 完成,RiskSense Inc. 进行了修改。 要利用此漏洞,请清除先前安装的任何 Impacket 版本,并从 https://github.com/SecureAuthCorp/impacket/commit/b867b21 或更新版本安装 Impacket。然后执行: root@kitploit: python3 setemptypw...

10CVSS8AI score0.99389EPSS
SaveExploits76References2
Kitploit
Kitploit
added 2026/09/22 10:30 a.m.13 views

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ Unauthenticated Privilege Escalation via Arbitrary Password Reset ☆ === Beelze === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-11387 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type| Missing Authenticatio...

9.8CVSS5.9AI score0.02208EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 9:30 a.m.13 views

CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

9.8CVSS8.2AI score0.90339EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/22 9:20 a.m.10 views

CVE-2025-4606

CVE-2025-4606- WordPress Sala Theme = 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover 🔥 Vulnerability Summary The WordPress theme Sala versions = 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attacke...

9.8CVSS8.3AI score0.00581EPSS
SaveExploits1
CVE
CVE
added 2026/09/22 8:57 a.m.12 views

CVE-2026-93556

Tankuam Places by Kompini is affected by an Insecure Direct Object Reference (IDOR) in the /password/guardarClau/recover endpoint. The endpoint accepts a usuariId parameter to specify which account's password to change, but the JWT token used in the recovery process is not validated against that ...

9.3CVSS5.8AI score0.00305EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/22 7:33 a.m.9 views

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

8.8CVSS5.9AI score0.00293EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/22 7:25 a.m.10 views

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

9.8CVSS6.2AI score0.01278EPSS
SaveExploits7References1
Kitploit
Kitploit
added 2026/09/22 6:35 a.m.11 views

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

9.8CVSS6.2AI score0.01383EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/22 4:08 a.m.9 views

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

9.8CVSS5.9AI score0.02948EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.239 views

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. id: CVE-2019-18818 info: name: strapi CMS 3.0.0-beta.17.5 - Admin Password Reset...

9.8CVSS8.2AI score0.97639EPSS
SaveExploits13References5
NVD
NVD
added 2026/09/21 10:16 p.m.7 views

CVE-2026-93340

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

7.4CVSS0.00313EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/21 10:06 p.m.8 views

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...

5.9CVSS7AI score0.26699EPSS
SaveExploits7
Kitploit
Kitploit
added 2026/09/21 9:44 p.m.10 views

CVE-2024-10508

Unauthenticated Privilege Escalation via Password Recovery on RegistrationMagic = 6.0.2.6 Disclaimer : This information is provided for educational purposes only. This document aims to raise awareness of security vulnerabilities and should not be used for any unauthorized or malicious activities...

9.8CVSS7.7AI score0.01518EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/21 9:43 p.m.9 views

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

7.5CVSS8.1AI score0.17212EPSS
SaveExploits5
CVE
CVE
added 2026/09/21 9:21 p.m.19 views

CVE-2026-93340

Gladys Assistant before version 5.1.0 is affected by a password reset link poisoning vulnerability in the forgot_password endpoint. The root cause is the server's acceptance of a client-supplied origin parameter without validation , allowing an unauthenticated remote attacker to craft a request w...

7.4CVSS5.9AI score0.00313EPSS
SaveExploits0References3
Rows per page
Query Builder