even-you-brutus
j-baines/even-you-brutusDictionary Brute Force of the Mikrotik RouterOS 6.x Web Interface
authenticationembedded-systems-securityexploitation+5
9
j-baines/even-you-brutusDictionary Brute Force of the Mikrotik RouterOS 6.x Web Interface
ajnik/joomla-bruteforcePython script that brute-forces Joomla administrator login credentials using wordlists, with proxy and verbose options for penetration testing.
abraxas/gofilexWordlist Bruteforcer for GoFile (gofile.io) Download Passwords
cyeezy08/kimai-cve-2026-52824-pocPoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) — Kimai time-tracking default APP_SECRET authentication bypass affecting versions ≤ 2.57.0
lxdwnpiper/cve-2026-48611-phpbbPython proof-of-concept exploit that bypasses authentication in phpBB 3.3.16 and below by forging session cookies to gain admin access.
nxploited/cve-2026-96451WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
rub-syssec/omenMarkov model-based password guesser in C that enumerates candidates by probability, generating most likely passwords first for hash cracking via…
langz337/cve-2026-14281Mass scanner and single-target exploit for CVE-2026-14281, an unauthenticated privilege escalation in the WordPress Automation Web Platform plugin…
antid00t/cve-2026-15989Python PoC scanner for CVE-2026-15989, exploiting unauthenticated role injection in WordPress Super Forms to create admin accounts and verify access.
aramosf/cve-2026-61500Python PoC and Docker lab for CVE-2026-61500: recovers Rejetto HFS V8 PRNG state to forge an admin session cookie and achieve RCE via server_code.
mrhenrike/embedxpl-forgeEmbedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs, ISP CPEs,…
rix4uni/wordlistCurated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…
polosss/by-poloss..-..cve-2026-19125Verified proof-of-concept exploiting the EthPress <= 2.3.5 unauthenticated authentication bypass, granting a WordPress administrator session via a…
fl0ydsec/cve-2026-63030Python mass exploit and detector for the WordPress Core pre-auth RCE chain CVE-2026-63030 and CVE-2026-60137, chaining SQL injection into remote code…
boydhacks/ntlmscoutUnauthenticated NTLM endpoint reconnaissance tool that decodes Type-2 challenges across HTTP, SMB, MSSQL, SMTP, IMAP, POP3, NNTP, LDAP, and RDP to…
faceless0x7/cve-2026-93453Python PoC for CVE-2026-93453, a SOGo password reset link poisoning flaw via attacker-controlled Origin header that enables reset token interception…
mlcsec/resetspyEnumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal
runzeroinc/sshambleResearch tool that scans SSH services for authentication bypasses, timing leaks, weak keys, and post-session exposures, with JSON output and analysis.