Tools

nxploited/cve-2025-8359

AdForest <= 6.0.9 - Authentication Bypass to Admin

clearcdq/zabbix-saml-sso-_cve-2022-23131

Exploit for CVE-2022-23131 targeting Zabbix SAML SSO authentication bypass vulnerability. Enables session hijacking and unauthorized admin access.

caelumisme/cve-2020-29607-poc

Python 3 exploit for Pluck CMS 4.7.13 file upload restriction bypass, enabling authenticated admin to upload a PHP webshell and achieve remote code…

eyodav/cve-2025-34157

A stored XSS in the project delete flow allows execution of attacker-controlled JavaScript in an administrator’s browser when the admin attempts to…

onurcangnc/cve-2025-57520-stored-xss-in-decap-cms-3.8.3-

A stored cross-site scripting (XSS) vulnerability exists in Decap CMS up to version 3.8.3. The issue affects multiple input fields in the **admin…

hossainshadat/cve-2025-57310

Proof-of-concept exploit for CVE-2025-57310: CSRF vulnerability in Simple-Faucet-Script v1.07 enabling stored XSS via crafted POST requests to the…

teteco/cve-2025-67070-intelbras-cftv-mfa-bypass

A critical vulnerability in the Intelbras NVD 9032 R Ftd IP CFTV device allows an attacker to bypass the multi-factor authentication during password…

d0n601/cve-2025-12399

Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

dedsecteam-blackhat/cve-2025-68860

Exploit script for CVE-2025-68860 targeting WordPress Mobile Builder plugin. Generates forged JWT tokens using a hardcoded secret to authenticate as…

himanshurahi1996/e107_2.1.9_csrf_poc

Proof-of-concept exploit for CVE-2018-17081, a Cross-Site Request Forgery vulnerability in e107 CMS 2.1.9, demonstrating unauthorized admin actions…

ahamedyaseen03/cve-2025-60375

CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM < 3.3.1 (admin login)

shoucheng3/xuxueli__xxl-job_cve-2020-29204_2-2-0

Exploit for CVE-2020-29204 targeting XXL-JOB distributed task scheduling framework, demonstrating remote code execution via unauthenticated access to…

jonathanrey87/cve-2020-25273

Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection.

giuseppesec/cve-2021-39512-bigtreecms-v4.4.14-accounttakeover

Proof-of-concept exploit demonstrating unauthenticated CSRF-based account takeover via reflected DOM-XSS in BigTreeCMS v4.4.14 admin panel.

kalidas-7/cve-2019-9053

Unauthenticated time-based blind SQL injection exploit for CMS Made Simple <= 2.2.9. Extracts admin credentials and optionally cracks password hashes…

wrathfuldiety/cve-2025-52357

Proof of Concept and Security Advisory for XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console (firmware V2.2.14). Includes…

cve-vuln/cve-2019-20059

Yetishare SQL Injection in sSortDir_0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF…