iTop - User Enumeration via REST Endpoint

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. id: CVE-2024-51739 info: name: iTop - User...

LG LED Assistant - Unauthenticated Password Reset

The /api/changePw endpoint in LG LED Assistant allows unauthenticated password resets when requests are considered to come from localhost. An attacker can spoof the X-Forwarded-For header with value 127.0.0.1 to trigger the behavior and receive a success response. id: CVE-2024-2862 info: name: LG...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

TranslatePress <= 3.3.1 - Unauthenticated Account Takeover

TranslatePress WordPress plugin = 3.3.1 contains a sensitive information exposure caused by the 'trpgettranslationsregular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string savi...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

Piwigo - User Enumeration via Password Reset

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at...

BMC FootPrints - Authentication Bypass

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability in the password reset functionality. Unauthenticated attackers can access the /footprints/servicedesk/passwordreset/request/ endpoint to obtain a valid SECTOKEN session cookie without proper...

Strapi-RCE

Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...

CVE-2024-10508

在 RegistrationMagic = 6.0.2.6 上通过密码恢复实现未经身份验证的权限提升 免责声明 ：此信息仅供参考和教育目的。本文档旨在提高对安全漏洞的认识，不应被用于任何未经授权或恶意的活动。未经许可利用这些漏洞的行为是非法且不道德的。 用于 WordPress 的 RegistrationMagic – User Registration Plugin with Custom Registration Forms 插件在 6.0.2.6...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - 認証なしの権限昇格（パスワード更新/アカウント乗っ取り） 📌 テーマ情報 プラグイン : Motors = 5.6.67 - 認証なしの権限昇格（パスワード更新/アカウント乗っ取り） 脆弱性のあるバージョン : = 5.6.67 CVE : CVE-2025-4322 重大度 : 9.8 緊急 CWE ID : CWE-620 CWE名 : 未確認のパスワード変更 パッチ適用済み : ✅ はい パッチ優先度 : 🔴 緊急 公開日 : 2025年5月19日 研究者 :...

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---未授权密码重置 漏洞信息 WordPress 的密码重置功能存在一个漏洞，在某些情况下可能允许攻击者在无需事先认证的情况下获取密码重置链接。 此类攻击可能导致攻击者未经授权访问受害者的 WordPress 账户。...

creak

creak ローカルネットワーク上のターゲットアドレスに対して、最も有名なMITM攻撃のいくつかを実行します。その中には、ARPポイズニング攻撃を実行し、ルーターへのすべてのリクエストにTCPリセットパケットを送信することで、ターゲットホストのネットワーク通信およびダウンロード機能を拒否するものがあります。 Python言語学習のための教育プロジェクトとして生まれたものであり、このコードの悪意のある使用や違法な使用を含む一切の悪用について、私は責任を負いません。 インストール root@kitploit: $ git clone...

CVE-2023-7028

CVE-2023-7028: CVE-2023-7028 Exploitation Tool Description: This Python script automates the exploitation of a hypothetical security vulnerability CVE-2023-7028 on GitLab instances. It facilitates password reset attacks on specified target email addresses, demonstrating a potential security risk...

CVE-2025-50433

CVE-2025-50433 — Critical Account Takeover Vulnerability Affecting Monnit Cloud Platforms .imonnit.com Summary A critical authentication vulnerability exists across .imonnit.com that allows full Account Takeover ATO on any user account without victim interaction. The backend fails to validate the...

zerologon

ZeroLogon エクスプロイトスクリプト エクスプロイトコードは https://www.secura.com/blog/zero-logon および https://github.com/SecuraBV/CVE-2020-1472 に基づいています。元の研究とスキャナーは Secura によるもので、RiskSense Inc. が修正を加えています。 エクスプロイトするには、既存の Impacket インストールをすべて削除し、https://github.com/SecureAuthCorp/impacket/commit/b867b21 以降の Impacket...

nice-cve-poc

精选 CVE PoC 一系列有趣的 CVE PoC CVE-2023-44487 - HTTP/2 快速重置攻击...

CVE-2026-72898

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection Metabase Pre-Authentication SQL Injection Leading to Admin Takeover Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the...

CVE-2024-13513.py

Usage Basic Usage bash python3 exploit.py -l targets.txt -e [email protected] Advanced Usage bash python3 exploit.py -l targets.txt -e [email protected] -t 100 -o /path/to/results Parameters Explanation Parameter Description Required Default -l, --list Path to file containing target URL...

CVE-2020-7378

CVE-2020-7378 – OpenCRX Predictable Password Reset Token and XXE Exploit This repository contains a combined proof-of-concept PoC exploit for CVE-2020-7378 , a critical vulnerability in OpenCRX versions up to and including 5.0-20200717. The exploit chains two core issues in the application: 1. A...