Tools

hann1bl3l3ct3r/cve-2026-6145

User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter

sanupl/vehicle-service-management-system-multiple-privilege-escalation-leads-to-crud-operations

CVE-2021-46075 - A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access…

sanupl/cve-2021-46075

CVE-2021-46075 - A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access…

xmyronn/cve-2026-10289-xss

Proof-of-concept for a stored XSS vulnerability in Hotel and Tourism Reservation System 1.0, demonstrating unauthenticated injection and admin…

0x0d3ad/cve-2020-14008

CVE-2020-14008 - ManageEngine Applications Manager RCE

xmyronn/cve-2026-10243-auth

Proof of concept demonstrating unauthenticated access to critical admin functions in Smart Parking System 1.0, allowing account creation, data…

etahen/etahen

PS5 homebrew enabler payload offering post-exploitation features: custom plugin/payload loading, unsigned fself/fpkg support, debug settings, FTP…

dennisec/cve-2026-41940

Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with…

yuhuamiao/cve-2026-36358

Proof-of-concept demonstrating a stored XSS vulnerability in Juzaweb CMS v5.0.0 via the banner ads HTML field, leading to arbitrary script execution…

cybercrewinc/cve-2026-36341

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM (HTML Injection)

kirubel-cve/cve-2026-36959

Proof-of-concept exploit for CVE-2026-36959, a missing rate limiting vulnerability in U-SPEED Router firmware allowing brute-force attacks on the…

watchtowrlabs/watchtowr-vs-cpanel-whm-authbypass-to-rce.py

Detection artifact generator that verifies cPanel/WHM authentication bypass (CVE-2026-41940) and demonstrates RCE via CRLF injection, targeting WHM…

xmyronn/cve-2026-7401-xss

Proof-of-concept for stored XSS in SourceCodester CET Automated Grading System 1.0, demonstrating unauthenticated payload injection via student…

xmyronn/cve-2026-7222-xss

Proof-of-concept exploit for stored XSS (CWE-79) in a PHP coaching management system, demonstrating session hijacking and privilege escalation from…

xmyronn/cve-2026-7394-sqli

Proof-of-concept exploit for CVE-2026-7394, a SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. Demonstrates authenticated…

0xdak/cve-2026-32136_exploit

Proof-of-concept exploit for CVE-2026-32136: unauthenticated authentication bypass in AdGuard Home via HTTP/2 cleartext (h2c) upgrade. Demonstrates…

jeanback1/cve-2025-2304-exploit

Python exploit script for CVE-2025-2304, a mass assignment privilege escalation in Camaleon CMS. Automates CSRF token parsing and role parameter…

turkios/cve-2026-32699-facturascripts-nick-bypass

Broken Access Control in FacturaScripts EditUser controller allows authenticated users to rename any account (including admin) by modifying the…