#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
randomrobbiebf/cve-2024-52429WP Quick Setup <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation
nxploited/cve-2025-3604Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover
nxploited/cve-2025-4796Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
apeppels/cve-2022-37017Bypass for Symantec Endpoint Protection's Client User Interface Password
itsnishat08/cve-2025-63700Technical documentation and proof-of-concept for CVE-2025-63700, an OAuth authentication bypass vulnerability in Clerk-js 5.88.0 allowing…
moften/cve-2025-29927_next.js_auth_bypassNext.js Auth Bypass PoC Edge Runtime Env Leak via Middleware Bug
baza-nato/cve-2021-33044Exploit for Dahua IPC/VTH/VTO devices that bypasses identity authentication by sending crafted malicious packets, allowing unauthorized access.
randomrobbiebf/cve-2024-9821Bot for Telegram on WooCommerce <= 1.2.4 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
rohitberiwala/cve-2026-28372-telnetd-privilege-escalationThis Proof‑of‑Concept demonstrates a **Local Privilege Escalation** vulnerability in GNU inetutils `telnetd`. `telnetd` improperly passes…
imbas007/auth-bypass-cve-2025-40554Proof-of-concept exploit for CVE-2025-40554, an authentication bypass in SolarWinds Web Help Desk. Includes Nuclei template and Python exploit for…
jenderal92/owa-valid-login-checkerOwa Valid Login Checker
mesh3l911/cve-2021-3138Discource POC
maleeshaudan/wordpress-cve-2024-10924--exploitWordPress CVE-2024-10924 Exploit for Really Simple Security plugin
trqt/cve-2024-48322Exploit for CVE-2024-48322 targeting RunCodes instances. Retrieves user passwords via email inbox after authentication bypass, requiring only any…
xthalach/cve-2024-11318This repository details an IDOR vulnerability in AbsysNet 2.3.1, which allows a remote attacker to brute-force session IDs via the /cgi-bin/ocap/…
randomrobbiebf/cve-2024-11848NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
randomrobbiebf/cve-2024-9106Wechat Social login <= 1.3.0 - Authentication Bypass
circuitsoul/poc-cve-2016-10555Change the algorithm RS256(asymmetric) to HS256(symmetric) - POC (CVE-2016-10555)
