Tools for testing, exploiting, and securing web applications and APIs.
mayca369/cve-2025-55182Demonstrates CVE-2025-55182 RCE exploit in React Server Functions to highlight insecure prototype references in Next.js, with educational simulation…
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
superman-l/cve-2026-16723Reproduces fastjson 1.2.83 @JSONType RCE with a vulnerable Spring Boot target and ASM-based payload generator using HTTP or file protocol jar chains.
sia-iotechnology/kittysploit-frameworkPython Exploitation Framework, V8 Engine Debugger, Proxy interceptor, marketplace, post-exploitation, backdoor generator,....
coreruleset/corerulesetGeneric attack detection rule set for web application firewalls, protecting against OWASP Top Ten and common vulnerabilities with minimal false…
open-flaw/cve-2026-56848Exploit PoC for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free that allows remote unauthenticated DoS. Includes raw-socket trigger, ASan build…
wattocyber/custom-oscp-toolingOSCP-focused toolkit for read-only network, SMB, AD, DNS, web, and database enumeration; privesc scanning, hash identification, and…
caddyserver/caddyFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
chaitin/safelineSelf-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…
deadexpl0it/cve-2026-19598-pocProof of Concept for CVE-2026-19598 affecting Pods <= 3.3.9.
future-architect/vulsAgent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
austin-weeks/miasmaTrap AI web scrapers in an endless poison pit.
biutrap/cve-2026-64849Proof-of-concept exploit for CVE-2026-64849: triggers SSRF in MLflow webhook API via crafted POST, fetching cloud instance metadata from…
cypherhippie/cve-2026-34486---unauthenticated-rce-via-java-deserializationEncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.
defacto-ridgepole254/cve-2026-41940-exploit-pocTest authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.
krixx1337/burner-netZero-trust anti-forensic HTTP client. Wipes secrets. Severs traces. CPR in a Stealth Tank. 👻
