Tools

hypnguyen1209/cve-2026-63520

Exploit chain for unauthenticated RCE on Microsoft SharePoint, combining a JWT authentication bypass with unsafe .NET type instantiation to achieve…

kmaruthisrikar/cve-2026-41940-cpanel-auth-bypass-exploit

Exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM, allowing unauthenticated attackers to gain root access via session injection and…

strikoder-premium/cve-2026-29000-pac4j-jwt

CVE-2026-29000 PoC: pac4j-jwt PlainJWT-in-JWE authentication bypass.

rosemary1337/cve-2026-41940

Proof-of-concept exploit for CVE-2026-41940, an unauthenticated authentication bypass in cPanel/WHM using CRLF injection to leak security tokens and…

typeconfused/cve-2026-24061

GNU telnetd service from GNU InetUtils authentication-bypass

sm1ee/cve-2026-39324

Proof-of-concept exploit for Rack::Cookie authentication bypass (CVE-2026-39324), demonstrating session forgery via fallback coder to gain admin…

manbahadurthapa1248/cve-2026-29000---pac4j-jwt-authentication-bypass-poc

Proof-of-concept exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt. Forges JWT tokens to gain admin access to protected endpoints.

kernelzeroday/cve-2026-29000

Forge JWE-wrapped unsigned JWTs to bypass pac4j-jwt signature verification (CVE-2026-29000) and authenticate as any user; includes Python CLI,…

bughunt4me/cpanelcve-2026-41940

Proof-of-concept exploit for CVE-2026-41940, a critical cPanel & WHM authentication bypass via session-file CRLF injection, enabling automatic root…

turkios/cve-2026-32699-facturascripts-nick-bypass

Broken Access Control in FacturaScripts EditUser controller allows authenticated users to rename any account (including admin) by modifying the…

simoesctt/sctt-2026-33-0004-forticloud-sso-identity-singularity

While Fortinet's January 27, 2026 mitigation for **CVE-2026-24858** focuses on blocking specific accounts like `[email protected]`, it fails to…

simoesctt/ctt-refraction-vortex-cve-2026-7731-

Exploit for CVE-2026-7731 targeting cloud-native identity gateways by refracting JWT temporal validation to escalate privileges from admin:false to…

rootx111/cve-2026-29000

Exploit for CVE-2026-29000, a JWT authentication bypass in pac4j-jwt via JWE-wrapped PlainJWT, allowing token forgery and privilege escalation.

rohitberiwala/cve-2026-28372-telnetd-privilege-escalation

This Proof‑of‑Concept demonstrates a **Local Privilege Escalation** vulnerability in GNU inetutils `telnetd`. `telnetd` improperly passes…

maxmnml/smartermail-cve-2026-23760-poc

CVE-2026-23760 - An authentication bypass via password reset API in SmarterMail.

itsismarcos/cve-2026-41940

Automated exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM, allowing unauthorized administrative access to vulnerable servers.

dennisec/cve-2026-41940

Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with…