kavryxdev-group/sandboxed-untrusted-code-execution-runnerExecutes untrusted Python, JavaScript, and Bash in a hardened jail with 5-second, 128 MB, 0.5-core, PID and output limits.
abraxas/jellyfin-playlist-itemidsJellyfin Server 12.2 - High - Remote - IDOR - public playlist ItemIds leftover of GHSA-9x85 then unauth stream
abraxas/jellyfin-suggestions-idorJellyfin Server 12.2 - High - Remote - IDOR - GET /Items/Suggestions omit-userId dumps hidden library Path and IDs
owasp/secretsifterOWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic).
abraxas/pfsense-api-acb-userkeypfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - ACB userkey capability URL
abraxas/pfsense-api-acme-key-dumppfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET /services/acme dumps keys
abraxas/pfsense-api-export-key-getpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET export-key private keys
abraxas/pfsense-api-fleet-jwtpfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - one controller JWT is a fleet token
abraxas/pfsense-api-snort-file-joinpfSense Plus MIM API toolkit b4acd7ca - High - Remote - File read - Snort rules {file} decode-then-join
ambitsecurity/jshoundFind every API request a web app makes, from the JavaScript it ships: method, URL, body, headers and GraphQL operations. One command.
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
abraxas/gitea-follow-existenceDemonstrates a Gitea account-enumeration oracle: authenticated PUT /api/v1/user/following/{username} returns 204 for hidden accounts and 404 for…
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
abraxas/gitea-stargazers-hiddenProof-of-concept and lab for an unauthenticated Gitea information disclosure: the stargazers and watchers API leaks usernames that profile endpoints…
abraxas/gitea-user-keys-idorProof-of-concept and lab for a Gitea IDOR (CWE-639) in GET /api/v1/user/keys/{id}, letting an authenticated read:user token enumerate other users'…
abraxas/hyperswitch-payout-confirm-secretProof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…
abraxas/lago-invite-atoProof-of-concept lab demonstrating a critical Lago GraphQL acceptInvite authentication bypass that enables cross-organization account takeover via…
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
