CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

white-deface

Author WHITE-DEFACE This is a simple tool to automatically deface vulnerable websites. Tutorial video link at last of this page ⚠️ It uses WebDav vulnerability to exploit. This script sends a PUT requests to the websites given in the targets.txt file. Unauthenticated requests will be accepted and...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard API RCE sin autenticación Versión: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: root@kitploit: IP:PORT/apisix/admin/migrate/export...

CVE-2024-27956

WP Automatic Plugin SQL Injection Exploit CVE-2024-27956 A proof-of-concept exploit for the SQL injection vulnerability in WP Automatic plugin CVE-2024-27956 affecting WordPress sites. 📌 Description This exploit targets a critical unauthenticated SQL injection vulnerability in the WP Automatic...

CVE-2024-4040

Exploit Code for CVE-2024-4040 Overview This exploit code targets the CVE-2024-4040 vulnerability, allowing unauthorized access to user accounts by reading and validating tokens stored in the "sessions.obj" file. If the tokens are valid, hackers can gain entry to the targeted accounts. Unlike oth...

CVE-2021-34045

CVE-2021-34045 druid unauthorized access batch scanning poc Tool Usage python3 CVE-2021-34045.py -u http://127.0.0.1:1111 单个url测试 python3 CVE-2021-34045.py -f url.txt 批量检测 Disclaimer Any direct or indirect consequences and losses caused by the dissemination or use of the information provided in...

CVE-2018-12463

CVE-2018-12463 XML external entity XXE vulnerability in /ssc/fm-ws/services in Fortify Software Security Center SSC 17.10, 17.20 & 18.10 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request.. Exploit-DB...

CVE-2026-82221

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82225

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82229

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81768

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81298

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-81290

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Unauthenticated Arbitrary Options Update Description The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated...