violin
strategic-automation/violinAgentic pentest profile for Hermes: 31 playbooks for authorised recon, web/access-control attacks, safe exploit validation, and evidence-driven…
authentication-authorizationexploitationosint+8
135
strategic-automation/violinAgentic pentest profile for Hermes: 31 playbooks for authorised recon, web/access-control attacks, safe exploit validation, and evidence-driven…
tc4dy/cve-2026-0073-poc-exploitZero-click authentication bypass exploit for Android ADB Wireless Debugging (CVE-2026-0073). Provides interactive shell, command execution, and…
ethicalgrey/phpbb-cve-2026-48611Automated PoC for CVE-2026-48611 — phpBB OAuth login_link authentication bypass
synacktiv/sccmsecretsSCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement.
franc-pentest/ldeepIn-depth ldap enumeration utility
aramosf/cve-2026-24031Self-contained Python PoC for Dovecot SQL authentication bypass: logs in as any user without the real password and enumerates usernames on vulnerable…
sfewer-r7/cve-2026-55040Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…
digicred-oss/caos-osCustomer Assurance Operating System. Answer the security questionnaires your customers send you, once.
sam00/poc-cve-2026-56164-exploitCVE-2026-56164 is a critical missing-authentication vulnerability affecting on-premises Microsoft SharePoint Server. It allows unauthenticated,…
rootsecdev/secretsstalkerRead-only Entra ID app-credential assessment: enumerates Graph permissions, Azure RBAC, and reachable cloud data, then maps findings to…
instructor-admin/cve-2026-15964-pocPoC & checker for CVE-2026-15964 - unauthenticated password change in the WordPress plugin Single Sign On For TNG <= 2.0.0 (CVSS 9.8)
aj2108/cve-2026-8239Security write-up for an IDOR in Concrete CMS exposing conversation ratings through missing authorization on the get_rating endpoint, with root…
heltonpojo/cve-2025-32432Pre-auth RCE exploit for Craft CMS in Go. Grabs session/CSRF token, poisons PHP session, triggers deserialization for command execution or reverse…
cerberusmrxi/cpanel-whm-cve-2026-41940-auth-bypass-exploitCritical authentication bypass exploit for cPanel/WHM CVE-2026-41940. Leverages CRLF injection in cpsrvd daemon to gain root WHM access without…
tc4dy/cve-2026-60206-poc-exploit👾 CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework ⚡Bash & Python versions. Features: --detect safe check, --exploit…
cerberusmrxi/discuz-x5.0-authentication-bypass-exploit-frameworkDiscuz! X5.0 Authentication Bypass Exploit Framework (CVE-2026-49952) - Critical vulnerability allowing unauthenticated database backup access via…
tc4dy/cve-2026-41940-poc-exploit🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy,…
teteco/cve-2026-52217-vtex-checkout-crosstenant-idorThe VTEX Checkout Service exposes OrderForm data through the endpoints `/api/checkout/pub/orderForm/{orderFormId}` and `/attachments/*`. These…