#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended
abraxas/nextcloud-ldap-put-isadminNextcloud 35.0.0 — delegated Users admin can PUT-edit an LDAP-promoted admin that PATCH correctly refuses
abraxas/joomla-menu-items-apiJoomla 6.1.3 - High - Remote - ACL - menu items API leftover
abraxas/joomla-levels-apiJoomla 6.1.3 - High - Remote - ACL - GET /api/v1/users/levels leaks view levels
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
7acini/cve-2026-102261Non-destructive Go verifier that checks whether a Camaleon CMS instance applies the authorization fix for CVE-2026-102261 in the media crop endpoint.
abraxas/grafana-signup-invite-joinGrafana OSS 13.2.3 - High - Remote - Invite join - SignUpStep2 joins pending org invites without the code
kavryxdev-group/enterprise-abac-gatewayZero-trust reverse proxy and ABAC authorization gateway in Go with embedded OPA policy evaluation and distributed token revocation.
abraxas/openmeetings-soap-user-rightsApache OpenMeetings 9.1.0 - High - Remote - Privilege leftover - SOAP POST /user copies UserDTO.rights including ADMIN
abraxas/sqlite-fj-using-authSQLite 3.53.4 - High - Local - Privilege leftover - FULL JOIN USING skips sqlite3AuthRead
nihal799/zttpZero-trust SSH bastion proxy with Vault-backed key management, RBAC policy enforcement, full session recording, and admin TUI for auditable access to…
abraxas/forgejo-keys-idorForgejo 16.0.5 - High - Remote - IDOR - GET /api/v1/user/keys/{id} returns other users SSH and deploy keys
htrxuan/hdwebmobile-booking-appointmentsSell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
abraxas/joomla-articles-catidJoomla 6.1.3 - High - Remote - ACL - POST /api/v1/content/articles ignores per-category ACL
mrjhaxcore/cve-2025-34077WordPress Pie Register ≤ 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
abraxas/opnsense-captive-lastseen-roamOPNsense 26.7.6 - High - Remote - Network-access bypass - captive lastseen roam
abraxas/pfsense-ldap-name-collisionpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - LDAP admin name
watchtowrlabs/kentico-xperience13-authbypass-wt-2025-0011Python script for checking authentication bypass vulnerability (WT-2025-0011) in Kentico Xperience 13 CMS Staging Service via POST request analysis.
schroeder-sys/pantheon-souveraineteInfrastructure cloud modulaire, redondante et 100% souveraine pour s'affranchir des GAFAM. Guides techniques, architecture Zero-Trust et chiffrement…
