Tools

ajnik/joomla-bruteforce

Python script that brute-forces Joomla administrator login credentials using wordlists, with proxy and verbose options for penetration testing.

lxdwnpiper/cve-2026-48611-phpbb

Python proof-of-concept exploit that bypasses authentication in phpBB 3.3.16 and below by forging session cookies to gain admin access.

4ybrick/cve-2026-100903

PoC and enumeration script for CVE-2026-100903, a missing-authentication flaw in the GEO.RITM REST API that leaks object and driver data anonymously.

arensballiu/flowise-cve-2025-58434-passwordreset

Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password…

s3v3n-jg/cve-2026-76460

Educational Flask lab simulating CVE-2026-76460 authentication bypass, with vulnerable, secure, and strict modes plus a PoC exploit script and…

bombobombone/cve-2026-73310

Proof of concept and technical write-up for CVE-2026-73310, an OAuth2 authorization code redirect URI binding flaw in XenForo before 2.3.13,…

bombobombone/cve-2026-73312

Proof-of-concept and technical write-up for CVE-2026-73312, an OAuth2 refresh token replay vulnerability in XenForo before 2.3.13. Includes a Python…

sercanokur/cve-2026-41940-cpanel-whm-verification-tool

Python verification script for CVE-2026-41940, an authentication bypass in cPanel & WHM, enabling authorized defensive validation and patching…

realawaisakbar/cve-2026-41940-exploit-poc

Proof-of-concept exploit for CVE-2026-41940, an authentication bypass in cPanel & WHM, enabling unauthenticated access to the control panel.

keraattin/cve-2026-35616

Detection toolkit for CVE-2026-35616, a pre-authentication API bypass in FortiClient EMS. Includes Python scanner and Nmap NSE script for identifying…

jake-young-dev/cve-2026-29000

Proof-of-concept exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt, demonstrating JWT crafting with arbitrary roles for unauthorized…

hd0x01/cve-2026-24061-nse

The script performs a full Telnet negotiation mirroring the exact byte sequence of a real telnet -a client session.

andrei-dr/cpanel-cve-2026-41940-ioc

CVE-2026-41940 cPanel/WHM auth bypass IOC scanner — fixes false positives in upstream detection script, adds log cross-correlation

alaatk/cve-2026-35616

Fortinet FortiClientEMS improper access control

0xyur1/cve-2026-41940

cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)

kyos-public/keycloak-cve-2026-18963-hunt

Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database

minanagehsalalma/zyxel-social-login-bypass-cve-2026-8508

Public writeup, PoC, and emulation materials for CVE-2026-8508 affecting Zyxel captive-portal social login.

quahac/azure-ad-password-checker

Azure AD Password Checker