Tools

ght657/work1-secure-api

HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis

abraxas/pfsense-api-export-key-get

pfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET export-key private keys

abraxas/pfsense-api-fleet-jwt

pfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - one controller JWT is a fleet token

zentinelproxy/zentinel

A security-first reverse proxy built to guard the free web.

abraxas/gitea-public-only-pat-org

Proof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…

abraxas/hyperswitch-payout-confirm-secret

Proof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…

abraxas/lago-stripe-invoice-idor

Reproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…

abraxas/forgejo-keys-idor

Forgejo 16.0.5 - High - Remote - IDOR - GET /api/v1/user/keys/{id} returns other users SSH and deploy keys

abraxas/joomla-levels-api

Joomla 6.1.3 - High - Remote - ACL - GET /api/v1/users/levels leaks view levels

abraxas/joomla-articles-catid

Joomla 6.1.3 - High - Remote - ACL - POST /api/v1/content/articles ignores per-category ACL

abraxas/joomla-menu-items-api

Joomla 6.1.3 - High - Remote - ACL - menu items API leftover

vulncheck-oss/cli

VulnCheck's official command line tool

piratesshield/apiharvester

The one shot API attacker tool - finds the API url from the given root simulate the automated attacks

bombobombone/cve-2026-102973

Sanitized report and local proof-of-concept script demonstrating the MediaWiki action=emailuser API EmailUserAuthorizeSend hook bypass…

hakaioffsec/cve-2026-16764

Python exploit for CVE-2026-16764, a privilege escalation in OWASP DefectDojo where an is_staff REST API bypass lets a low-privileged user gain…

hasanuyarrr/cve-2026-18783-trex-mes-uygulamalarinda-yetkisiz-nesne-erisimi

Advisory for CVE-2026-18783: missing server-side authentication on TREX MES /api/GetDataJSON3 allows unauthenticated data queries and arbitrary SQL…

tuskira/ai-agent-gateway

Open-source gateway that secures, governs, and observes AI agents' MCP tool calls and LLM traffic, with API-key authentication and an admin console…