Tools

kartik2005221/cve-2025-58434-poc

Proof-of-concept exploit for CVE-2025-58434, demonstrating unauthenticated account takeover in Flowise via leaked password reset tokens. Includes…

cveteam/flowiseai-critical-killchain

Critical unauthenticated kill chain leading to full RCE in FlowiseAI (CVE-2025-58434 + CVE-2025-59528)

0xdaeras/flowise-cve-2025-58434-chain-59528

FlowiseAI CVE-2025-58434 & CVE-2025-59528 exploit PoC, demonstrating unauthenticated ATO via reset token leakage, followed by authenticated RCE.…

r3nsi15/flowise-cve-2025-58434-passwordreset

Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password…

yucaerin/cve-2025-4322

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

rootdirective-sec/cve-2026-8181-lab

Docker lab demonstrating CVE-2026-8181 authentication bypass in Burst Statistics WordPress plugin. Compares vulnerable and patched versions with a…

rootdirective-sec/cve-2026-44338-lab

Docker-based lab demonstrating CVE-2026-44338 authentication bypass in PraisonAI's legacy Flask API. Includes vulnerable and patched services with…

alardiians/pocketbase-cve-2026-44166

Lab + writeup for CVE-2026-44166: PocketBase OAuth2 account pre-hijacking via unvalidated createData.email

covepseng/cve-2026-43512-poc

Exploitability PoC for CVE-2026-43512 (Apache Tomcat Digest Authentication Bypass)

bimboxh4/cve-2025-66039_cve-2025-61675_cve-2025-61678_reepbx

This vulnerability allows both authenticated and unauthenticated remote attackers to execute remote code on vulnerable FreePBX instances. These…

eliasdekiniweek/cve-2022-26923

Exploitation de CVE-2022-26923

sohaibeb/cve-2025-0108

PAN-OS CVE POC SCRIPT

0xnehru/ssh_enum_vaild

A Bash script to enumerate valid SSH usernames using the CVE-2018-15473 vulnerability. It checks for valid usernames on an OpenSSH OpenSSH 7.2p2…

bodoinon/cve-2024-10924

Demonstrates exploitation and mitigation of CVE-2024-10924, an authentication bypass in WordPress Really Simple Security, with automated Python…

illera88/cve-2021-21239

Exploit for CVE-2021-21239: SAML signature validation bypass in pysaml2/Redash. Forges SAML responses with embedded public keys to impersonate users…

danielhallbro/cve-2025-29927-nextjs-bypass-poc

A Proof of Concept for CVE-2025-29927 demonstrating a middleware bypass in Next.js versions prior to 13.5.9

vini0608/cve-2022-23361

CVE-2022-23361

olimpiofreitas/cve-2025-29927-scanner

Python scanner that detects Next.js instances vulnerable to CVE-2025-29927, identifies versions, and tests for authentication bypass via the…