Tools for testing, exploiting, and securing web applications and APIs.
yora1928/cve-2026-15748Scans WordPress Forminator for CVE-2026-15748 unauthenticated RCE. Detects vulnerable sites, crawls forms, extracts nonces, runs safe upload tests.
horkimhab/cve-2026-19650-cve-2026-19478Proof-of-concept exploit resources for CVE-2026-19650 and CVE-2026-19478 targeting a GitLab GraphQL vulnerability, intended for authorized research,…
ytkoka/impersonate-proxyA local MITM proxy that lets you control TLS fingerprints (JA3/JA4), HTTP/2 fingerprints, HTTP header order, and User-Agent — all from a single YAML…
nitindevelopermca/ai-vulnerability-remediation-studyStudy of CVE-2018-6341 in React, demonstrating AI-assisted vulnerability detection, root-cause analysis, and remediation guidance for JavaScript…
wattocyber/masqLive recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.
l4st98/cve-2026-33017-fireflowProof-of-concept RCE for Langflow CVE-2026-33017 using a malicious custom component to execute OS commands via build_public_tmp and retrieve output…
toanln-cov/cve-2026-74251Unauthenticated SQL Injection via Attribute Filter in Phoca Cart
jvr2022/cve-2026-40345Reproduces a stack-exhaustion denial-of-service in deepmerge-ts before 8.0.0, documents exploitation, and includes a scanner for vulnerable…
lulztigre/cve-2026-41042Exploits unauthenticated RCE in Apache Gravitino < 1.2.1 via H2 JDBC INIT; hosts SQL/Java payloads, executes commands, and exfiltrates output over…
c00ln3t/log4shellauditorAn autonomous reflective Go agent for full-cycle security auditing, WAF evasion, OOB LDAP verification, self-remediation (auto-patching), and…
hereticl1nk/eits-portal-exploit-cve-2026-31367-pocPoC exploit for unauthenticated RCE in EITS Admin Dashboard v2.4.0 via command injection in /api/v1/debug, allowing arbitrary OS command execution on…
vognik/cve-2026-26980Unauthenticated SQL injection exploit for Ghost CMS Content API (CVE-2026-26980); dumps database tables from SQLite/MySQL with active/passive checks…
cyberauth/cve-2026-20079Implements the CVE-2026-20079 authentication-bypass-to-root-RCE chain against Cisco Secure FMC using fingerprint, check, proof, and interactive…
biutrap/cve-2026-59310Proof-of-concept exploit for CVE-2026-59310, demonstrating remote path traversal via crafted syslog messages to write arbitrary log files on VMware…
nel-droid/cve-2026-71203-pocPoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)
nel-droid/cve-2026-71204-pocPoC: changedetection.io settings blind-merge mass assignment (CVE-2026-71204, Medium 6.3)
nel-droid/cve-2026-71205-pocPoC: changedetection.io unlimited login brute-force, no rate limiting (CVE-2026-71205, Medium 6.5)
nel-droid/cve-2026-71206-pocPoC: Shiori JWT CheckToken never re-validates account state (CVE-2026-71206, High 8.2)
