Tools for testing, exploiting, and securing web applications and APIs.
mattiacervelli/cve-2025-24893_analysisSelf-contained Docker lab that reproduces CVE-2025-24893, an unauthenticated SSTI-to-RCE in XWiki SolrSearch, and compares vulnerable vs patched…
anirbala98/cve-2026-539594gaBoards < 3.3.9 - User Information Disclosure
rosemary1337/cve-2025-24799Exploits GLPI CVE-2025-24799 via unauthenticated time-based blind SQL injection to extract usernames and password hashes from glpi_users for…
bebarossi/grav-cve-2024-28116Analysis and Docker reproduction of CVE-2024-28116 - SSTI with sandbox bypass in Grav CMS
rosemary1337/cve-2025-6934Automated PoC exploit for WordPress Opal Estate Pro that detects vulnerable versions, retrieves nonce, and creates unauthorized administrator…
bsdrip/cve-2026-40179-pocMinimal Python PoC for CVE-2026-40179: injects a malicious metric name via unauthenticated Prometheus remote_write to trigger stored XSS in the web…
open-flaw/cve-2026-56848Exploit PoC for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free that allows remote unauthenticated DoS. Includes raw-socket trigger, ASan build…
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
artwiderobo/cve-2026-13934Structured vulnerability research repo for a Chrome Dawn WebGPU CWE-20 flaw: root cause, patch diff, static verification, severity review, and…
kaleth4/cve-2026-64638Technical analysis and defensive mitigation for a WordPress Core pre-auth XSS-to-RCE chain, including sanitizer bypass, DOM clobbering, JSONP abuse,…
velessecurity/cve-2020-14882-weblogic-analysisTechnical analysis and clean Java Thread Echo PoC for Oracle WebLogic Server vulnerability chain.
imabee101/cve-2023-44487PoC script for HTTP/2 Rapid Reset (CVE-2023-44487) that sends crafted HTTP/2 streams to trigger denial-of-service conditions on vulnerable servers,…
camillegr/cve-2026-73292Proof-of-concept exploit for CVE-2026-73292: CSRF attack on Semaphore UI password change endpoint, serving a malicious page that silently resets an…
ilhomjonr/cve-2026-70376Advisory and Python PoC for Pluck CMS CSRF: fail-open Referer check plus double-extension upload enables webshell deployment and remote code…
alkimcoskun/cve-2025-69848-security-advisoriesSecurity advisory for CVE-2025-69848 – Reflected XSS in NetBox ProtectedError handling
ilhomjonr/cve-2026-71518Advisory and PoC for an unauthenticated authorization bypass in Typemill media downloads, using path-equivalent URL variants to access…
burjoy/cve-2024-40275_scannerScanner for CVE-2024-40725 Apache HTTP Server source-code disclosure; probes direct and subrequest paths, fingerprints affected versions, and outputs…
davkharrr/cve-2026-19478-pocProof-of-concept exploit for unauthenticated remote code injection in GitLab's GraphQL API, using crafted queries to modify or delete public projects…
