Tools

alaatk/cve-2026-35616

Fortinet FortiClientEMS improper access control

vanlam2001/csrf_casdoor

Proof-of-concept CSRF exploit for Casdoor's `/api/set-password` endpoint (CVE-2023-34927), enabling unauthorized password changes via cross-site POST…

arensballiu/flowise-cve-2025-58434-passwordreset

Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password…

eqstlab/cve-2026-18963

Proof-of-concept exploit for CVE-2026-18963, demonstrating unauthenticated account takeover by bypassing the reset-credentials flow in web…

o-sec/cve-2026-41452-poc

Proof-of-concept exploit for CVE-2026-41452, a critical authentication bypass in Krayin CRM <= 2.2.4 allowing unauthenticated admin account takeover…

ull0a/cve-2024-55591-poc

Educational implementation in Go for CVE-2024-55591 (Fortinet FortiOS Authentication Bypass). Designed for security research, vulnerability…

bombobombone/cve-2026-73311

Proof-of-concept exploit demonstrating OAuth2 authorization code reuse in XenForo before 2.3.13, allowing token replay and multiple token families.

bombobombone/cve-2026-73310

Proof of concept and technical write-up for CVE-2026-73310, an OAuth2 authorization code redirect URI binding flaw in XenForo before 2.3.13,…

0xlyvio/cve-2026-1529-keycloak-exploit-tool

Keycloak: Unauthorized organization registration via improper invitation token validation

0xlyvio/cve-2026-18963-keycloak

Proof-of-concept exploit for CVE-2026-18963, a Keycloak reset-credentials bypass leading to account takeover. Demonstrates the vulnerability and…

blackhatexploitation/exploit-for-cve-2026-18963

Exploit for CVE-2026-18963, a critical unauthenticated account takeover in Keycloak's reset-credentials flow, chaining two bugs to bypass email…

t0w0t/poc-cve-2026-18963

Proof-of-concept exploit for CVE-2026-18963, an authentication bypass in Keycloak's forgot-password flow, allowing password reset without proper…

polosss/by-poloss..-..cve-2026-15038-poc

POC 4 CVE-2026-15038

l0ggg/cve-2026-55040

Exploit code for CVE-2026-55040, it can create auth header for any validate account.

debajyoti0-0/cve-2026-60206

Technical analysis and Proof-of-Concept for CVE-2026-60206, a critical Oracle WebLogic Server SAML authentication bypass vulnerability.

pannagkumaar/pentest-lab

Modern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…

rufflabs/crushftp_cve-2025-31161

Pre-built vulnerable CrushFTP 10.8.0 binary for authorized penetration testing of CVE-2025-31161, an unauthenticated authentication bypass…