#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended
m-cetin/cve-2024-0204This script exploits the CVE-2024-0204 vulnerability in Fortra GoAnywhere MFT, allowing the creation of unauthorized administrative users, for…
abraxas/joomla-levels-apiJoomla 6.1.3 - High - Remote - ACL - GET /api/v1/users/levels leaks view levels
saml-toolkits/ruby-samlRuby library implementing the SAML Service Provider side of SSO, handling authn requests, response validation, XML signature checks, and IdP metadata…
abraxas/nextcloud-ldap-put-isadminNextcloud 35.0.0 — delegated Users admin can PUT-edit an LDAP-promoted admin that PATCH correctly refuses
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
cn016/apache-shenyu-admin-jwt-cve-2021-37580-Apache ShenYu Admin JWT认证绕过漏洞(CVE-2021-37580)
sigstore/root-signingMaintains the TUF repository that securely delivers the Sigstore trust root (trusted_root.json) to clients, using keyholder threshold signing, KMS…
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
abraxas/joomla-menu-items-apiJoomla 6.1.3 - High - Remote - ACL - menu items API leftover
abraxas/sqlite-fj-using-authSQLite 3.53.4 - High - Local - Privilege leftover - FULL JOIN USING skips sqlite3AuthRead
abraxas/hyperswitch-payout-confirm-secretProof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…
mrpayloadc/cve-2025-0316-exploitAutomated auth bypass exploit for CVE-2025-0316 targeting WordPress WP Directorybox Manager. Features user enumeration, proxy support,…
luisdevpentest/cve-2023-28121-wordpress-privilege-escalationExploração prática de vulnerabilidade crítica no WordPress usando o plugin WooCommerce Payments.
abraxas/proftpd-sftp-copy-file-writeProFTPD 1.3.9d - High - Remote - Privilege leftover / File write - SFTP copy-file skips dest WRITE
abraxas/forgejo-keys-idorForgejo 16.0.5 - High - Remote - IDOR - GET /api/v1/user/keys/{id} returns other users SSH and deploy keys
abraxas/mysql-set-role-leftoverMySQL Community Server 26.7.0 - High - SET ROLE ALL EXCEPT leftover FILE - mysqld UID write
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
abraxas/superset-g3-v0-import-sql-plantProof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…
