Tools

randomrobbiebf/cve-2024-54378

Quietly Insights <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

randomrobbiebf/cve-2024-54379

Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

randomrobbiebf/agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

Agency Toolkit <= 1.0.23 - Missing Authorization to Unauthenticated Arbitrary Options Update

randomrobbiebf/cve-2024-50488

Token Login <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation

h4wkst3r/adokit

Modular attack toolkit exploiting Azure DevOps REST API for reconnaissance, privilege escalation, and persistence using stolen cookies or PATs.

coby-nguyen/document-linux-privilege-escalation

Exploiting the vulnerability called "Dirty_Sock" (CVE-2019-7304) in the REST API for Canonical's snapd daemon.

randomrobbiebf/cve-2024-6624

JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

nxploited/cve-2024-49328-exploit

Python script to exploit a privilege escalation vulnerability in the WP REST API FNS WordPress plugin, allowing unauthenticated creation of…

evict/poc_cve-2018-1002105

Proof-of-concept exploit for CVE-2018-1002105 targeting Kubernetes API server. Supports authenticated and unauthenticated privilege escalation to…

jenderal92/cve-2024-6624

Python exploit script for CVE-2024-6624 targeting unauthenticated privilege escalation in the JSON API User WordPress plugin. Automates user…

trandonga3/poc-cve-2026-63030-cve-2026-60137-

Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…

george0papasotiriou/cve-2026-3030-prototype-pollution-in-json-merge-patch

Demonstrates CVE-2026-3030 prototype pollution in a Node.js JSON merge patch REST API, including a vulnerable server and exploit script for privilege…

zaydbf/cve-2025-9074-poc

Bash-based PoC exploit for CVE-2025-9074 targeting unauthenticated Docker Engine API to achieve container escape and remote code execution via…

vyahello/cve-2026-31431

Linux local privilege escalation exploit for CVE-2026-31431, abusing the AF_ALG crypto API with splice() to modify page cache and spawn a root shell.

rocket-panda/cve-2025-9074

Bash-based exploit script for CVE-2025-9074 that abuses the internal Docker API to mount the host C drive, execute commands inside a container, and…

abdurahmon3236/cve-2024-36539

PoC exploit for insecure permissions in Contour v1.28.3 that retrieves a Kubernetes service account token and accesses the cluster API, demonstrating…

paulotrindadec/cve-2021-44103

Proof-of-concept exploit for CVE-2021-44103 demonstrating vertical privilege escalation in Konga API Gateway 0.14.9, allowing authenticated users to…