Tools

bombobombone/cve-2026-102973

Sanitized report and local proof-of-concept script demonstrating the MediaWiki action=emailuser API EmailUserAuthorizeSend hook bypass…

bombobombone/cve-2026-73318

Proof-of-concept exploit for XenForo CVE-2026-73318, an authorization bypass allowing ACP administrators to trigger site-wide policy re-agreement.…

bombobombone/cve-2026-73309

Proof-of-concept and technical write-up for CVE-2026-73309, an OAuth2 authentication bypass in XenForo before 2.3.13. Demonstrates empty…

sfewer-r7/cve-2026-55040

Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…

dz-y/azure-apim-dev-portal-signup-bypass

Python script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…

george0papasotiriou/cve-2026-3456-oauth2-pkce-race-condition-account-takeover-

Python PoC for CVE-2026-3456 demonstrating OAuth2 PKCE race-condition account takeover, with a vulnerable auth server and concurrent code-verifier…

sfewer-r7/cve-2026-16232

A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token.

kaleth4/cve-2026-20896

Automated PoC exploit for CVE-2026-20896, a Gitea authentication bypass via directory traversal in the API authorization header, enabling…

cybertechajju/cve-2026-45156-poc

This repository contains the Proof of Concept (PoC) exploit script for CVE-2026-45156

offseckit/cve-2026-23813

CVE-2026-23813 — AOS-CX pre-auth bypass via nginx regex. Detection script, bypass demo, config-disclosure PoC, and IDS rules.

0xyur1/cve-2026-41940

cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)

zf-tm/cve-2026-29000

PoC of the CVE-2026-29000

dennisec/cve-2026-41940

Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with…

dhiaelhak-rached/cve-2026-39987-lab-or-marimo-cve-lab

Educational Docker lab demonstrating CVE-2026-39987, a pre-auth RCE via WebSocket authentication bypass in marimo, with exploit script and patch…

nxploited/cve-2026-4484

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

s1incere/cve-2023-22515

Confluence Unauthorized Administrator User Addition Exploitation Script

k4ptor/cve-2023-22515

Confluence Unauthorized Administrator User Addition Exploitation Script