#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
abraxas/opnsense-captive-lastseen-roamOPNsense 26.7.6 - High - Remote - Network-access bypass - captive lastseen roam
watchtowrlabs/kentico-xperience13-authbypass-wt-2025-0011Python script for checking authentication bypass vulnerability (WT-2025-0011) in Kentico Xperience 13 CMS Staging Service via POST request analysis.
leosol/initrootExploiting CVE-2016-10277 for Secure Boot and Device Locking bypass
the-infra-company/kcatcherCatch what's lurking in your Kafka clusters.
les-k/wp-secure-mcpA WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by…
pervinzahidli/cve-2026-103977Session-scoped TOTP rate limiting permits repeated verification attempts
randomrobbiebf/cve-2022-0952Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
watchtowrlabs/kentico-xperience13-authbypass-wt-2025-0006Authentication bypass detection script for Kentico Xperience 13 CMS Staging Service using a single POST request to verify vulnerability.
oxstussz-eng/kerberos-cve-2026-27912PoC for CVE-2026-27912 - Windows Kerberos Elevation of Privilege (ResetNightmare). Unauthorized password reset via Kerberos flaw. For security…
9lyph/cve-2022-43704Sinilink XY-WFTX Wifi Remote Thermostat Module Temperature Controller
4b3r4m4-607d/cve-2026-63030-pocCVE-2026-63030 / wp2shell
synacktiv/itsm-exploitIvanti Neurons for ITSM (On Premise) exploits
boreas37/cve-2026-41452-pocCVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5
ignis-sec/cve-2019-10008ManageEngine Service Desk Plus 10.0 Privilaged account Hijacking
haingn/lohongcam-cve-2021-33044Python exploit for Dahua device authentication bypass (CVE-2021-33044). Sends crafted malicious data packets to bypass login and gain unauthorized…
abraxas/bitwarden-cipher-create-aclBitwarden Server v2026.9.2 - High - IDOR - plant decryptable vault items into collections the caller cannot write
zhengxr930/apex_officialDefender framework for LLM agent security that compiles task contracts, validates capability manifests, and checks effects via PLANT/WRAP proof…
alihussainzada/cve-2025-29927-pocPoC for CVE-2025-29927: Next.js Middleware Bypass Vulnerability. Demonstrates how x-middleware-subrequest can bypass authentication checks. Includes…
