watchTowr-vs-Progress-ShareFile-CVE-2026-2699

CVE-2026-2699 Progress ShareFile Authentication Bypass Progress ShareFile Authentication Bypass Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if Progress ShareFile instance is vulnerable to CVE-2026-2699 authentication bypass. Detection Artifact Generato...

CVE-2023-32707

CVE-2023-32707 An improved POC exploit based on the reported CVE on exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Overview This script allows for exploiting a vulnerability in Splunk 9.0.5, leading to admin account takeover. The exploit leverages a low-privile...

Lepus

Lepus Lepus is a tool for enumerating subdomains, checking for subdomain takeovers and perform port scans - and boy, is it fast! Basic Usage root@kitploit: lepus.py yahoo.com Summary Enumeration modes Subdomain Takeover Port Scan Installation Arguments Full command example Enumeration modes The...

Recheck

Recheck Recheck Deep scan domain and find all possible domain to takeover Quick Links Demo Installation Feature Example Run / Installation How to run ? root@kitploit: git clone https://github.com/tegal1337/Recheck cd Recheck npm install npm start Feature Feature| Status ---|--- Deepscan domain| O...

moodle-cve

Challenge creation Inspiration moodle CVE-2025-26529: posoning admin logs to full admin account takeover @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU @ref: https://github.com/NightBloodz/moodleTestingEnv @ref: https://medium.com/@Nightbloodz/admin-account-takeover-in-moodle-093708a0f749...

nginx-ui-CVE-2026-42221-CVE-2026-42238-

nginx-ui CVE Verification Environment This repository is for actually verifying two CVEs reported for nginx-ui Nginx's Web GUI management tool in a Docker environment. CVE-2026-42221 : Unauthenticated administrator account takeover CVE-2026-42238 : Command execution via unauthenticated backup...

w3af

w3af - إطار عمل هجوم وتدقيق تطبيقات الويب w3af هو ماسح أمان تطبيقات ويب مفتوح المصدر يساعد المطورين ومختبر الاختراق على تحديد واستغلال الثغرات في تطبيقات الويب الخاصة بهم. الماسح قادر على تحديد أكثر من 200 ثغرة، بما في ذلك Cross-Site Scripting، SQL injection و OS commanding. المساهمة طلبات السحب...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover Unauthenticated Admin Account Takeover in WordPress Multisite 📋 Overview InfiniteWP Client plugin for WordPress 1.13.6 contains a critical authentication bypass vulnerability affecting Multisite installations. An unauthenticated attacker can: 🔓...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

CVE-2025-4796

CVE-2025-4796 Eventin Once the email is changed to an attacker-controlled address, the standard WordPress password reset flow can be used to take over the account. 🧰 Script PoC Filename: CVE-2025-4796.py This script automates the steps: 1. Log in to the target WordPress site using supplied...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

fast-security-scanners

ماسحات/فحوصات أمنية سريعة مساهمة صغيرة للمجتمع : نستخدم كل هذه الأدوات في تقييمات الأمن وفي خدمة مراقبة الثغرات الخاصة بنا تحقق من نطاقك لاستيلاء DNS NS المستودع docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover تسميم ذاكرة التخزين المؤقت المستودع...

CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Metabase — Unauthenticated SQL Injection → Full Administrator Takeover 📌 Overview CVE-2026-72898 is a maximum-severity CVSS 10.0 unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the...

blmvuln

Corriger les principales vulnérabilités de sécurité sur les sites PrestaShop :rocket: Détecteur et correcteur de la CVE-2022-31101 ! Une faille nouvellement découverte pourrait permettre à des attaquants distants de prendre le contrôle de votre boutique...

r3con

R3CON Multifunctional Web Recon & Vulnerability Scanner Tool r3con is a Multifunctional Web Recon & Vulnerability Scanner Tool and incredibly fast crawler that can find multiple vulnerabilitys and gather information. Check for vulnerabilities Reflected XSS Multi-threaded crawling Open-redirection...

CVE-2017-8295

CVE-2017-8295 Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lead to an attacker gaining unauthorised access to a victim's WordPress account...

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php. id: CVE-2023-43374 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin = 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request. id: CVE-2025-14998 info:...