Tools

baktistr/cve-2026-23550-poc

Bash-based proof-of-concept tester for CVE-2026-23550. Checks WordPress modular connector login endpoints for admin cookie issuance and verifies…

1beelze/cve-2026-5118

Automated exploit and mass scanner for CVE-2026-5118, an unauthenticated privilege escalation in WordPress Divi Form Builder <=5.1.2, enabling admin…

sangsenimanwartefak/cve-2026-23550

Bash exploit for CVE-2026-23550 that triggers unauthenticated WordPress admin login via crafted REST API request to Modular Connector's…

minhhk68/cve-2026-13158

Proof-of-concept exploit and technical advisory for an Admin+ arbitrary file upload to remote code execution vulnerability in Everest Toolkit…

dx3iz/cve-2026-0920

Creating a Wordpress Admin User

zer0dayf/cve-2026-15013

Exploit for CVE-2026-15013: unauthenticated SAML auth bypass via algorithm confusion. Forges SAML responses to gain admin access and deploy…

xmyronn/cve-2026-7222-xss

Proof-of-concept exploit for stored XSS (CWE-79) in a PHP coaching management system, demonstrating session hijacking and privilege escalation from…

cedric1314/cve-2022-44870

maccms admin+ xss attacks

deepsecurityresearch/cve-2025-14340

PoC for CVE-2025-14340: Admin account takeover in Payara Server

biulove0x/cve-2022-1903

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

estebanzarate/cve-2025-2304-camaleon-cms-mass-assignment-privilege-escalation-poc

Proof-of-concept exploit for a mass assignment privilege escalation vulnerability in Camaleon CMS < 2.9.1. Authenticated low-privilege users can…

xmyronn/cve-2026-11518-xss

Proof-of-concept for unauthenticated stored XSS in SourceCodester Inventory System, demonstrating admin session hijacking via crafted registration…

gurjotexpert/cve-2023-3460

Proof-of-concept exploit for CVE-2023-3460, a WordPress Ultimate Member privilege escalation vulnerability. Creates an admin account via crafted…

lukasz-rybak/cve-2025-67875

CVE-2025-67875 - ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

yuhuamiao/cve-2026-36358

Proof-of-concept demonstrating a stored XSS vulnerability in Juzaweb CMS v5.0.0 via the banner ads HTML field, leading to arbitrary script execution…

gitgudkrish/cve-2025-29927-nextjs

Educational demo of CVE-2025-29927, a critical Next.js middleware authentication bypass. Includes a vulnerable admin panel, proof-of-concept exploit…

echosecure/vuln-chain-lab

PoC Docker lab: chaining file upload bypass + stored XSS to create admin accounts. Educational resource for pen testers.