Tools

bishopfox/cve-2026-27886-check

Detect whether a Strapi instance is vulnerable to CVE-2026-27886 (unauthenticated boolean-oracle exfiltration of administrator secrets).

hunt-benito/siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

Unauthenticated administrator takeover exploit for CVE-2026-66012 using MCP missing authorization to exfiltrate credentials and achieve remote code…

thvt0ne/cve-2025-28062

proof of concept

deepsecurityresearch/cve-2025-14340

PoC for CVE-2025-14340: Admin account takeover in Payara Server

nxploited/cve-2025-13390

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

calfcrusher/cve-2023-31853

Proof-of-concept for reflected XSS in Cudy LT400 web interface, demonstrating session cookie theft and admin takeover via crafted requests.

fatmatrabelsi17/cve-2025-14221

Proof-of-concept for CVE-2025-14221: Stored XSS in SourceCodester Online Banking System 1.0 via unsanitized First Name field, enabling session…

nicetop1027/cve-2026-discord

Critical vulnerability report detailing zero-day Remote Debugging Port exposure in Discord macOS client leading to account takeover, spyware, worm…

giuseppesec/cve-2021-39512-bigtreecms-v4.4.14-accounttakeover

Proof-of-concept exploit demonstrating unauthenticated CSRF-based account takeover via reflected DOM-XSS in BigTreeCMS v4.4.14 admin panel.

w33vils/cve-2020-35847_cve-2020-35848

CVE-2020-35847, CVE-2020-35848 : Account Takeover

security-n/cve-2021-39377

Proof-of-concept for CVE-2021-39377, a SQL injection vulnerability in openSIS 8.0 via the username parameter, enabling database takeover through…

nixwizard/cve-2018-15365

Proof-of-concept exploit for reflected XSS in Trend Micro Deep Discovery Inspector 3.8, enabling CSRF bypass and admin account takeover via…

minendie/poc_cve-2024-40492

Proof-of-concept for CVE-2024-40492: stored XSS vulnerability in heartbeat.chat leading to account takeover. Includes reproduction steps and impact…

calfcrusher/cve-2023-31852

Proof-of-concept for reflected XSS in Cudy LT400 web interface, demonstrating session cookie theft and admin takeover via crafted requests.

calfcrusher/cve-2023-31851

Proof-of-concept for reflected XSS in Cudy LT400 web interface, demonstrating session cookie theft and admin takeover via crafted requests.

amirhosseinjamshidi64/cve-2026-7567-poc

Proof-of-concept exploit for CVE-2026-7567, an authentication bypass in WordPress Temporary Login Plugin <= 1.0.0, enabling account takeover. For…

prot0tw/keycloak_cve-2026-18963_poc

This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).

red-darkin/cve-2026-18963-keycloak

Proof-of-concept exploit for CVE-2026-18963, a critical Keycloak reset-credentials bypass enabling unauthenticated account takeover. Includes lab…