CVE-2023-5561-PoC

PoC CVE-2023-5561 - WordPress User Email Disclosure Description This script exploits the CVE-2023-5561 vulnerability in WordPress to enumerate and disclose user email addresses via the /wp-json/wp/v2/users API endpoint. Requirements Python 3.x requests library Install the required library: pip...

CVE-2018-9995

Tool show DVR Credentiales Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel optimized from CodeHolic Exploit: $ curl...

fortigate-cve-2022-40684-tool

Description This tool allows security professionals to identify and validate exposure to CVE-2022-40684 in FortiGate devices by interacting with exposed CMDB API endpoints. It supports enumeration of administrative users, user groups, and selective configuration extraction for analysis in...

Jira Server and Data Center - Information Disclosure

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from...

EUVD-2026-101709

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid...

CVE-2026-102298

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid...

CVE-2026-102298

The Omada Controller in MSP mode contains an authorization bypass vulnerability in the user-confirmation endpoint . Due to a failure to enforce required permission checks, an authenticated user can provide a caller-controlled Identifier parameter to validate credentials for other accounts. The en...

CVE-2026-102298 Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid...

ResetSpy

ResetSpy Probe Microsoft's Self-Service Password Reset SSPR endpoint to enumerate registeted verification methods and flag any that lack a strong second factor. Provides user enumeration and an approximation of MFA posture across Entra accounts. !NOTE As of August 2026, Microsoft has removed the...

CVE-2026-103907

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkitpostblock' and 'jegfindauthor' AJAX actions in versions up to, and including, 3.2.19. The 'wpajaxjkitpostblock' handler registered generically for eve...

CVE-2024-44762-webmin-userenum

This repository does not have a README...

CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 is vulnerable to user enumeration because it returns distinct error messages depending on whether the user exists or not. This allows an attacker to send multiple HTTP authentication requests to perform brute-force attacks. Although a protection mechanism exists to...

PT-2026-113935

Name of the Vulnerable Software and Affected Versions Omada Controller affected versions not specified Description In MSP mode, the user-confirmation endpoint fails to enforce necessary permission checks. An authenticated user can provide a caller-controlled Identifier parameter to validate...

PT-2026-113709

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit post block' and 'jeg find author' AJAX actions in versions up to, and including, 3.2.19. The 'wp ajax jkit post block' handler registered generically...

CVE-2016-6210-OpenSSH-User-Enumeration

This repository does not have a README...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...

CVE-2017-10797

CVE-2017-10797 CVE-2017-10797- User Enumeration in OwnCloud Server 8.1-10.0...

userenum-CVE-2018-15473

Userenum CVE-2018-15473 User enumeration for CVE-2018-15473 This script is a method to use a user dictionary with the CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io. Script developed to solve Valentine HTB machine. How to use it 1st. Download the main...

CVE-2026-25197

CVE-2026-25197: Authorization Bypass via User-Controlled Key IDOR Advisory Field| Value ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher|...

wpUsersScan

wpUsersScan About wpUsersScan Enumerate the users list of the wordpress websites through the REST API / CVE-2017-5487,WordPress 4.7.1 - Username Enumeration Usage $ python wpUsersScan.py URL How to install Clone Clone the repository with: $ git clone https://github.com/ihebski/wpUsersScan.git $ c...