Password-Reset — PoC Archivehttps://poc.intelseclab.com/tags/password-reset/Latest proof-of-concept entries.Hugoen-usTue, 11 Aug 2026 00:00:00 +0000Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912)https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/High severity (CVSS 8) — network · CVE-2026-27912. Status: Patched. Affects: Microsoft Windows Kerberos Key Distribution Center (KDC), Change Password protocol (kadmin/changepw). Tags: windows, kerberos, active-directory, privilege-escalation, password-reset, domain-controller, upn, rubeus, changepw, krbtgt, CWE-285, microsoft, CVE-2026-27912.networkHighwindowskerberosactive-directoryprivilege-escalationpassword-resetdomain-controllerupnrubeuschangepwkrbtgtCWE-285microsoftCVE-2026-27912WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49901-simple-link-directory-password-reset-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49901-simple-link-directory-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-49901. Status: Weaponized. Affects: WordPress "Simple Link Directory" plugin (qc-simple-link-directory by quantumcloud). Tags: wordpress, wordpress-plugin, simple-link-directory, qc-opd, authentication-bypass, password-reset, broken-authentication, cwe-288, username-enumeration, python.webCriticalwordpresswordpress-pluginsimple-link-directoryqc-opdauthentication-bypasspassword-resetbroken-authenticationcwe-288username-enumerationpythonSmarterMail Auth Bypass via Password Reset to Pre-Auth RCE (CVE-2025-52691 / WT-2026-0001)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-52691-smartermail-auth-bypass-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-52691-smartermail-auth-bypass-rce/Critical severity (CVSS 10) — web · CVE-2025-52691. Status: Weaponized. Affects: SmarterMail (SmarterTools webmail/mail server). Tags: smartermail, smartertools, webmail, authentication-bypass, password-reset, rce, volume-mounts, pre-auth, watchtowr, python.webCriticalsmartermailsmartertoolswebmailauthentication-bypasspassword-resetrcevolume-mountspre-authwatchtowrpythonSimple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-53580. Status: Weaponized. Affects: quantumcloud "Simple Business Directory Pro" WordPress plugin (simple-business-directory-pro). Tags: wordpress, wordpress-plugin, simple-business-directory-pro, password-reset, privilege-escalation, incorrect-privilege-assignment, cwe-266, account-takeover, unauthenticated, python.webCriticalwordpresswordpress-pluginsimple-business-directory-propassword-resetprivilege-escalationincorrect-privilege-assignmentcwe-266account-takeoverunauthenticatedpythonWordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-12416, CVE-2026-12417. Status: Weaponized. Affects: SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416). Tags: wordpress, wp-plugin, account-takeover, password-reset, auth-bypass, ajax, mass-exploitation.webCriticalwordpresswp-pluginaccount-takeoverpassword-resetauth-bypassajaxmass-exploitationStrapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Critical severity — web · CVE-2026-27886. Status: Weaponized. Affects: Strapi CMS (Content API). Tags: strapi, cms, account-takeover, password-reset, boolean-oracle, api-filter-bypass, authentication.webCriticalstrapicmsaccount-takeoverpassword-resetboolean-oracleapi-filter-bypassauthenticationSmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0001-smartermail-password-reset/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0001-smartermail-password-reset/Critical severity (CVSS 9) — web · CVE-2026-0001 (tracked publicly as WT-2026-0001). Status: PoC. Affects: SmarterTools SmarterMail (webmail/admin control panel), typically on port 9998. Tags: smartermail, auth-bypass, password-reset, email-server, unauthenticated, rce-chain, smartertools, api.webCriticalsmartermailauth-bypasspassword-resetemail-serverunauthenticatedrce-chainsmartertoolsapiSmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23760-smartermail-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23760-smartermail-auth-bypass/Critical severity (CVSS 9.3) — web · CVE-2026-23760. Status: PoC. Affects: SmarterTools SmarterMail. Tags: smartermail, authentication-bypass, password-reset, account-takeover, rce, email-server, watchtowr.webCriticalsmartermailauthentication-bypasspassword-resetaccount-takeoverrceemail-serverwatchtowrSimple History Missing Authorization Account Takeover — CVE-2026-7459https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7459-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7459-poc/High severity (CVSS 7.5) — web · CVE-2026-7459. Status: PoC. Affects: Simple History (WordPress plugin). Tags: wordpress, simple-history, broken-access-control, account-takeover, rest-api, password-reset.webHighwordpresssimple-historybroken-access-controlaccount-takeoverrest-apipassword-resetFOSSBilling Unauthenticated API Key Config Disclosure & Password Reset Token Reuse — CVE-2026-53647https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53647-fossbilling-chained-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53647-fossbilling-chained-rce/Medium severity (CVSS 6.9) — web · CVE-2026-53647 (also documents chained CVE-2026-53646). Status: PoC. Affects: FOSSBilling (open-source billing/client management platform). Tags: fossbilling, api-key-disclosure, password-reset, token-reuse, account-takeover, unauthenticated, ghsa, php.webMediumfossbillingapi-key-disclosurepassword-resettoken-reuseaccount-takeoverunauthenticatedghsaphpARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Critical severity (CVSS 9.8) — web · CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074). Status: PoC. Affects: ARMember – Membership Plugin & Content Restriction (WordPress plugin). Tags: wordpress, armember, membership-plugin, sql-injection, password-reset, plaintext-key, account-takeover, cwe-640.webCriticalwordpressarmembermembership-pluginsql-injectionpassword-resetplaintext-keyaccount-takeovercwe-640