The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...

CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

CVE-2025-22963

Overview Cross-site request forgeryCSRF vulnerability in Teedy versions = v1.11 allows remote attackers to force an end user to change their user informationusername, password, etc... on the web application in which they're currently authenticated. Vulnerability User information change endpoint i...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

cve-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE...

CVE-2018-0114

CVE-2018-0114 before 0.11.0 unathenticated remote attacker can re-sign using a key embeded in token. https://www.cvedetails.com/cve/CVE-2018-0114/...

CVE-2016-0040

CVE-2016-0040 This exploit builds upon SMMRootkit's 32Bit project https://github.com/Rootkitsmm/cve-2016-0040 which causes this vulnerability to trigger a BSoD with all 'a's in RCX and 'B's in RAX. It was ported to 64Bit Windows 7 SP1 and doesn't use the "mov rcx+06h, rax" instruction for inital...

CVE-2023-42793

TeamCity CVE-2023-42793 Exploit This Python script exploits a security vulnerability CVE-2023-42793 in JetBrains TeamCity, allowing an attacker to create a new user with administrative privileges. Usage The script takes either a single TeamCity instance URL or a list of URLs as input. The provide...

CVE-2024-42327

CVE-2024-42327: Zabbix Privilege Escalation - RCE Description This Proof-of-Concept POC can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server 6.0.32rc1, 6.4.17rc1, 7.0.1rc1 A non-admin user account on the...

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

CVE-2025-26399

CVE-2025-26399 How does this detection method work? This script detects SolarWinds Web Help Desk instances vulnerable to CVE-2025-26399 by requesting the Helpdesk login page, confirming product identifiers in the response, extracting the embedded build token as a version string, and flagging...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7 Description A Cross Site Request Forgery CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of...

DiscoRape

DiscoRape DiscoRape is a selfbot for Discord written in python3.8 The original repository I forked this from can be found here made by EC-discord Preview 📝 Install/Run pip3 install -r requirements.txt Add your token in data/config.json run by doing python3 selfbot.py...

CVE-2022-41544

CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...

365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

CVE-2023-38646

Metabase Pre Authentication RCE CVE-2023-38646 We have provided two files:- CVE-2023-38646-POC.py for checking if any metabase intance is leaking setup-token. CVE-2023-38646-Reverse-Shell.py to get a reerse shell on the attacker controlled machine. CVE-2023-38646-POC.py...

CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

CVE-2018-0114

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...

TokenTacticsV2

root@kitploit: / / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...