CVE-2026-8181
x48ps/cve-2026-8181This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by…
api-securityauthenticationexploitation+3
x48ps/cve-2026-8181This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by…
turkios/cve-2026-32699-facturascripts-nick-bypassBroken Access Control in FacturaScripts EditUser controller allows authenticated users to rename any account (including admin) by modifying the…
dennisec/cve-2026-41940Exploit script for CVE-2026-41940, an authentication bypass in cPanel/WHM using CRLF injection to gain admin access and change root password, with…
xmyronn/cve-2026-11518-xssProof-of-concept for unauthenticated stored XSS in SourceCodester Inventory System, demonstrating admin session hijacking via crafted registration…
lukasz-rybak/cve-2025-69216Proof-of-concept repository for CVE-2025-69216, an authenticated SQL injection in OpenSTAManager's Scadenzario print template, enabling extraction of…
nullbyte8080/cve-2026-36226Benign proof-of-concept for CVE-2026-36226, a cross-site scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 Admin Dashboard Create…
gurjotexpert/cve-2023-3460Proof-of-concept exploit for CVE-2023-3460, a WordPress Ultimate Member privilege escalation vulnerability. Creates an admin account via crafted…
xmyronn/cve-2026-10243-authProof of concept demonstrating unauthenticated access to critical admin functions in Smart Parking System 1.0, allowing account creation, data…
lukasz-rybak/cve-2025-67876Detailed CVE-2025-67876 proof-of-concept demonstrating stored XSS in ChurchCRM group role names leading to admin session hijacking, with full…
0xdak/cve-2026-32136_exploitProof-of-concept exploit for CVE-2026-32136: unauthenticated authentication bypass in AdGuard Home via HTTP/2 cleartext (h2c) upgrade. Demonstrates…
lukasz-rybak/cve-2025-67875CVE-2025-67875 - ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
xmyronn/cve-2026-7394-sqliProof-of-concept exploit for CVE-2026-7394, a SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. Demonstrates authenticated…
nxploited/cve-2025-13342Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
rio128128/mass-cve-2023-28121-kdoecCVE-2023-28121 - WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation [ Mass Add Admin User ]
hann1bl3l3ct3r/cve-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
bhanunamikaze/cve-2026-2587-exploit-pocCVE-2026-2587 PoC validator for Eclipse GlassFish EL Injection RCE in the admin console gadget.jsf handler. Safe authenticated vulnerability scanner…
xshadow-here/cve-2026-8181CVE-2026-8181 | Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
wr0x00/cve-2022-23131Exploit for CVE-2022-23131 targeting Zabbix SAML SSO authentication bypass. Generates a signed session cookie to gain unauthorized admin access.