CVE-2025-9209

🍔 RestroPress – 在线订餐系统 3.0.0 - 3.1.9.2 🛡️ CVE-2025-9209.py — 批量自动利用与提取工具 ⚠️ 漏洞概述 RestroPress – 在线订餐系统 版本 3.0.0 至 3.1.9.2 存在 未认证信息泄露 ，导致 通过伪造 JWT 绕过认证 。 该插件暴露了用户的私有令牌和 API 密钥数据，允许未认证攻击者伪造 JWT 令牌，从而完全访问其他用户（包括管理员）。 CVE 编号： CVE-2025-9209 CVSS 评分： 9.8（严重） 影响： 无需事先认证即可完全接管账户。 🚀 脚本功能...

CVE-2026-92913

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses a cryptographically weak PRNG in getRandomCode() (objects/functions.php), deriving account activation/login pairing codes from uniqid() with a single non-CSPRNG rand() character as padding, reducing the code space to ~2^25 valu...

CVE-2025-10658

Exploit: Fuerza Bruta OTP de Invitado de SupportCandy → Toma de Control de Cuenta 1 Iniciar el flujo de inicio de sesión con OTP navegador Abrir: root@kitploit: /support/ Seleccionar inicio de sesión como invitado / OTP Ingresar el correo electrónico objetivo ej. [email protected] Enviar 2...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover vulnerability

Authenticated Custom+ Missing Authorization to Limited Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Amelia versions = 2.4.4...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authentication Bypass to Admin Account Takeover Vulnerability Summary The WordPress plugin Burst Statistics versions 3.4.0 to 3.4.1.1 is vulnerable to an unauthenticated authentication bypass vulnerability that leads to full administrator account...

CVE-2025-58434-poc

CVE-2025-58434 — Flowise Account Takeover via Token Disclosure ⚠️ This repository is for educational and authorized security research only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Table of Contents Overview Vulnerability Details Attack Flow...

CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

EUVD-2026-81339

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2025-55182-GUI

CVE-2025-55182 Vulnerability Detection and Exploitation Tool GUI Version Project Overview This project is a graphical detection and exploitation tool targeting the high-risk CVE-2025-55182 vulnerability, developed with Python + tkinter to provide a fully graphical interface. It eliminates the nee...

csrf_casdoor

Casdoor – Cross-Site Request Forgery CSRF Summary Vulnerability: CSRF in /api/set-password allowing password changes without consent. Affected versions: All versions of the software are affected. No patched release is currently available. CVE: CVE-2023-34927 latest yet to be assigned. Exploit...

CVE-2025-4606

CVE-2025-4606 Overview This tool is used to test the vulnerability CVE-2025-4606 in WordPress using the Sala – Startup & SaaS WordPress Theme. This vulnerability allows Privilege Escalation through Account Takeover because the theme does not properly validate user identity before updating sensiti...

Joomla-CMS-Full-Lifecycle-Pentest

Full-Lifecycle CMS Penetration Testing Joomla 4.2.5 📌 Project Overview This project demonstrates a full-lifecycle penetration test conducted on an open-source CMS Joomla 4.2.5. The entire test follows standard methodologies OWASP/PTES from lab deployment up to exploitation, post-exploitation, and...

CVE-2026-7567-POC

描述 本仓库包含 CVE-2026-7567 的概念验证（PoC）。该漏洞影响 Wordpress 临时登录插件 = 1.0.0，允许攻击者绕过身份验证并接管账户。我仅出于教育和研究目的开发此漏洞利用程序/PoC。 使用方法 您只需使用以下单条命令即可运行： root@kitploit: python exploit.py CVE-2026-7567 NVD...

CVE-2026-18963

Keycloak 重置路径查找器 用于发现暴露的 Keycloak reset-credentials 端点的 Nuclei 模板，覆盖多个代理前缀、上下文路径、领域名称和路径变体。 摘要 该模板有助于识别可访问的密码重置流程，这些流程在验证受以下影响的环境时可能具有相关性： CVE-2026-18963 通过 reset-credentials 流程绕过实现 Keycloak 未认证账户接管 根据公开的 Keycloak 问题，该漏洞允许未认证攻击者强制对用户执行密码重置流程，而无需预期的电子邮件验证链接，从而可能导致完全账户接管。 参考：...

CVE-2023-7028

简介 GitLab 是一款被广泛应用的基于 Web 的代码仓库管理器，为软件开发项目中的源代码管理、集成、维护和协作提供了全面的平台 CVE-2023-7028 是一个允许攻击者通过 reset password 表单接管用户账户 Account TakeOver 的漏洞 该漏洞存在于以下 GitLab 版本中： 16.1 至 16.1.5 16.2 至 16.2.8 16.3 至 16.3.6 16.4 至 16.4.4 16.5 至 16.5.5 16.6 至 16.6.3 16.7 至 16.7.1 漏洞分析 该漏洞位于 reset password 表单中，具体是 GitLab ...

CVE-2026-34200

Nhost MCP 服务器：一键基础设施沦陷 官方公告：此漏洞已由 Nhost 确认并发布：GHSA-6c5x-3h35-vvw2 本仓库记录了 Nhost 本地 MCP 服务器中的一个漏洞。该服务缺乏入站身份验证，并实施了宽松的 CORS 策略，从而允许未经身份验证的跨源请求执行。 当 nhost mcp 处于活动状态时，仅需访问一次攻击者控制的源即可实现对整个项目的接管。成功执行后，攻击者将获得未经授权的访问权限，可进行以下操作： 窃取生产数据库内容 通过原始 SQL 迁移删除表 重写 Hasura 权限 劫持你的云 PAT 和管理员密钥 有关完整的技术分析、根本原因分析、PoC...

Keycloak_CVE-2026-18963_PoC

CVE-2026-18963 Keycloak reset-credentials bypass → unauthenticated account takeover CVSS 9.1 | Affected: Keycloak 26.0.0 – 26.7.1 Layout root@kitploit: CVE-2026-18963/ ├── cve202618963poc.py - PoC script Python 3.9+, stdlib only ├── README.md ├── docker-compose.yml - Lab environment └──...

CVE-2021-36460

CVE-2021-36460 NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460 MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460 CWE-836: 使用密码哈希代替密码进行身份验证 VeryFitPro 应用（Android: com.veryfit2hr.second，iOS）=3.3.7 在设备本地使用 SHA-1 对账户密码进行哈希处理，并在与后端 API...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation en Plugin Amelia WordPress ⚠️ Resumen Ejecutivo Vulnerabilidad crítica de Referencia Directa Insegura a Objetos IDOR en el plugin Amelia que permite a un usuario autenticado con rol de Empleado Provider escalar privilegios hasta toma de control total Account...

CVE-2026-21994

CVE-2026-21994 摘要 Oracle OKIT（oci-designer-toolkit）版本 0.3.0 包含两个严重的错误配置，可串联导致未经身份验证的完全接管。公开仓库中暴露的硬编码 Flask SECRETKEY 允许任何攻击者伪造有效的管理员会话 Cookie——无需任何凭据。此外，Docker 镜像完全禁用了 SSH 主机验证，使网络攻击者能够在基础设施部署期间拦截 OCI API 密钥和私钥。 漏洞 1. 硬编码SECRETKEY — okitclassic/okitserver/config.py:4 root@kitploit:...