#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended
leosol/initrootExploiting CVE-2016-10277 for Secure Boot and Device Locking bypass
the-infra-company/kcatcherCatch what's lurking in your Kafka clusters.
les-k/wp-secure-mcpA WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by…
pervinzahidli/cve-2026-103977Session-scoped TOTP rate limiting permits repeated verification attempts
roxanne_ardary/e2eauthCross-platform TOTP/HOTP authenticator specification with end-to-end encrypted vault sync, local-first storage, device management, and threshold…
randomrobbiebf/cve-2022-0952Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
watchtowrlabs/kentico-xperience13-authbypass-wt-2025-0006Authentication bypass detection script for Kentico Xperience 13 CMS Staging Service using a single POST request to verify vulnerability.
oxstussz-eng/kerberos-cve-2026-27912PoC for CVE-2026-27912 - Windows Kerberos Elevation of Privilege (ResetNightmare). Unauthorized password reset via Kerberos flaw. For security…
9lyph/cve-2022-43704Sinilink XY-WFTX Wifi Remote Thermostat Module Temperature Controller
4b3r4m4-607d/cve-2026-63030-pocCVE-2026-63030 / wp2shell
synacktiv/itsm-exploitIvanti Neurons for ITSM (On Premise) exploits
boreas37/cve-2026-41452-pocCVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5
dobybaxter127/nimbus-vestigeA forensic reconstruction engine for cloud and identity incident response.
ignis-sec/cve-2019-10008ManageEngine Service Desk Plus 10.0 Privilaged account Hijacking
haingn/lohongcam-cve-2021-33044Python exploit for Dahua device authentication bypass (CVE-2021-33044). Sends crafted malicious data packets to bypass login and gain unauthorized…
abraxas/bitwarden-cipher-create-aclBitwarden Server v2026.9.2 - High - IDOR - plant decryptable vault items into collections the caller cannot write
alihussainzada/cve-2025-29927-pocPoC for CVE-2025-29927: Next.js Middleware Bypass Vulnerability. Demonstrates how x-middleware-subrequest can bypass authentication checks. Includes…
ritwick7/sudostampApprove sudo on a Linux workstation with a fingerprint on your Android phone. LAN only; the ECDSA key never leaves the phone's TEE and speaks the…
