Tools

bdblackhat/admin-panel-finder

Python script to discover admin panel URLs of websites, aiding in security reconnaissance and penetration testing.

kalhoralireza/cve-2026-17532-lab

Docker lab demonstrating CVE-2026-17532, an unauthenticated reflected XSS in Seraphinite Accelerator that chains to RCE via admin session, with…

yasirr10/cve-2026-29000

Exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt allowing attackers to forge admin tokens using only the public key.

rakeshelamaran98/cve-2026-30081

Documentation of CVE-2026-30081, a high-severity cleartext transmission vulnerability in Quantum Networks QN-I-470 router firmware 6.1.1.B1, allowing…

kirubel-cve/cve-2026-36959

Proof-of-concept exploit for CVE-2026-36959, a missing rate limiting vulnerability in U-SPEED Router firmware allowing brute-force attacks on the…

drkim-dev/cve-2026-30862

Proof-of-concept demonstrating stored XSS in Appsmith Table Widget leading to vertical privilege escalation and full admin takeover via XSS-to-CSRF…

cybercrewinc/cve-2026-36341

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM (HTML Injection)

xmyronn/cve-2026-7401-xss

Proof-of-concept for stored XSS in SourceCodester CET Automated Grading System 1.0, demonstrating unauthenticated payload injection via student…

xmyronn/cve-2026-7089-xss

Proof-of-concept for CVE-2026-7089, a stored XSS in Home Service System PHP 1.0 allowing unauthenticated admin session hijacking via booking form.

xmyronn/cve-2026-10289-xss

Proof-of-concept for a stored XSS vulnerability in Hotel and Tourism Reservation System 1.0, demonstrating unauthenticated injection and admin…

turkios/cve-2026-32699-facturascripts-nick-bypass

Broken Access Control in FacturaScripts EditUser controller allows authenticated users to rename any account (including admin) by modifying the…

thetorjancaptain/cve-2026-23550-poc

CVE-2026-23550 - Modular DS WordPress Plugin **Unauthenticated Admin Access**

shenal01/cve-2025-60880

Proof-of-concept for a stored XSS vulnerability in Bagisto admin panel, demonstrating SVG upload with malicious JavaScript and providing mitigation…

null200ok/cve-2026-3228

Scans and exploits CVE-2026-3228, a stored XSS in NextScripts WordPress plugin, with pre-auth detection, authenticated checks, and payload injection…

leonideath/exploit-lpe-cve-2026-21721

Proof-of-concept exploit for CVE-2026-21721 that escalates privileges to admin on affected dashboards, requiring a valid Editor account.

unpredictable21/halo-cors-csrf-cve-2026-67921

Proof-of-concept demonstrating a combined CORS misconfiguration and CSRF protection bypass in Halo CMS, enabling cross-site request forgery attacks…

yuhuamiao/cve-2026-36358

Proof-of-concept demonstrating a stored XSS vulnerability in Juzaweb CMS v5.0.0 via the banner ads HTML field, leading to arbitrary script execution…