jellyfin-playlist-itemids
abraxas/jellyfin-playlist-itemidsJellyfin Server 12.2 - High - Remote - IDOR - public playlist ItemIds leftover of GHSA-9x85 then unauth stream
api-securitydata-exfiltrationinformation-gathering+5
abraxas/jellyfin-playlist-itemidsJellyfin Server 12.2 - High - Remote - IDOR - public playlist ItemIds leftover of GHSA-9x85 then unauth stream
abraxas/jellyfin-suggestions-idorJellyfin Server 12.2 - High - Remote - IDOR - GET /Items/Suggestions omit-userId dumps hidden library Path and IDs
abraxas/pfsense-api-acb-userkeypfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - ACB userkey capability URL
abraxas/pfsense-api-acme-key-dumppfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET /services/acme dumps keys
abraxas/pfsense-api-snort-file-joinpfSense Plus MIM API toolkit b4acd7ca - High - Remote - File read - Snort rules {file} decode-then-join
ambitsecurity/jshoundFind every API request a web app makes, from the JavaScript it ships: method, URL, body, headers and GraphQL operations. One command.
abraxas/gitea-follow-existenceDemonstrates a Gitea account-enumeration oracle: authenticated PUT /api/v1/user/following/{username} returns 204 for hidden accounts and 404 for…
abraxas/gitea-stargazers-hiddenProof-of-concept and lab for an unauthenticated Gitea information disclosure: the stargazers and watchers API leaks usernames that profile endpoints…
abraxas/gitea-user-keys-idorProof-of-concept and lab for a Gitea IDOR (CWE-639) in GET /api/v1/user/keys/{id}, letting an authenticated read:user token enumerate other users'…
abraxas/nextcloud-calendar-sharee-publishNextcloud 35.0.0 — a calendar edit-sharee can publish the owner's calendar to an unauthenticated URL
vulncheck-oss/cliVulnCheck's official command line tool
asvorg/cve-2026-105030-pocA python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
bombobombone/cve-2026-103440Report summary and local proof-of-concept script demonstrating CVE-2026-103440, a PageTriage API disclosure of suppressed reviewer usernames on…
abraxas/cve-2026-15583Proof-of-concept client and Docker lab reproducing CVE-2026-15583, an unauthenticated confused-deputy SSRF in Grafana MCP Server that leaks…
rmhowe425/poc-cve-2026-93680Proof-of-concept exploit for CVE-2026-93680 demonstrating MCP SSE authentication bypass and data exfiltration via tool invocation.
mr-redoo7/cve-2026-27739-pocPython PoC exploiting CVE-2026-27739 in Angular SSR: header injection via prototype pollution and SSRF chaining to AWS IMDS/GCP metadata for…
faceless0x7/cve-2026-89012Python exploit for CVE-2026-89012, a Dolibarr SQL filter denylist bypass that uses a blind-boolean oracle to extract password hashes and API keys via…
yggcwhat/cve-2021-45232Batch vulnerability scanner that integrates FOFA to discover and test Apache APISIX Dashboard instances for CVE-2021-45232 unauthorized access.