az0x7/vulnerability-checklistCurated collection of web and API vulnerability checklists covering XSS, SQLi, CSRF, IDOR, authentication bypass, file upload, and bug bounty testing…
abraxas/jellyfin-playlist-itemidsJellyfin Server 12.2 - High - Remote - IDOR - public playlist ItemIds leftover of GHSA-9x85 then unauth stream
abraxas/jellyfin-suggestions-idorJellyfin Server 12.2 - High - Remote - IDOR - GET /Items/Suggestions omit-userId dumps hidden library Path and IDs
owasp/secretsifterOWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic).
abraxas/pfsense-api-acb-userkeypfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - ACB userkey capability URL
abraxas/pfsense-api-acme-key-dumppfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET /services/acme dumps keys
abraxas/pfsense-api-export-key-getpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET export-key private keys
abraxas/pfsense-api-fleet-jwtpfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - one controller JWT is a fleet token
abraxas/pfsense-api-snort-file-joinpfSense Plus MIM API toolkit b4acd7ca - High - Remote - File read - Snort rules {file} decode-then-join
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
abraxas/gitea-follow-existenceDemonstrates a Gitea account-enumeration oracle: authenticated PUT /api/v1/user/following/{username} returns 204 for hidden accounts and 404 for…
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
abraxas/gitea-user-keys-idorProof-of-concept and lab for a Gitea IDOR (CWE-639) in GET /api/v1/user/keys/{id}, letting an authenticated read:user token enumerate other users'…
abraxas/hyperswitch-payout-confirm-secretProof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…
abraxas/lago-invite-atoProof-of-concept lab demonstrating a critical Lago GraphQL acceptInvite authentication bypass that enables cross-organization account takeover via…
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
abraxas/nextcloud-calendar-sharee-publishNextcloud 35.0.0 — a calendar edit-sharee can publish the owner's calendar to an unauthenticated URL
gmh5225/llm-guard-serviceA service to provide protection against prompt injection, jailbreak attacks, and harmful content when interacting with AI services..
