svja
theronielanddaronpodcastshow/svjaThe Super Vulnerable Java Application (SVJA), as demonstrated in the Roniel and DaRon Podcast Show, is an Apache Struts application designed to…
api-security-testingauthentication-authorizationeducation+5
13
theronielanddaronpodcastshow/svjaThe Super Vulnerable Java Application (SVJA), as demonstrated in the Roniel and DaRon Podcast Show, is an Apache Struts application designed to…
rachidafaf/bola-cve-2023-27524Demonstrates CVE-2023-27524 Broken Object Level Authorization (BOLA) vulnerability with vulnerable and fixed Flask API implementations for security…
erev0s/vampiVulnerable REST API with OWASP top 10 vulnerabilities for security testing
owasp/crapiDeliberately vulnerable microservices API designed for hands-on training in the OWASP API Security Top 10 risks, with built-in challenges and a…
dolevf/damn-vulnerable-graphql-applicationDamn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…
roottusk/vapivAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
owasp/dvsaa Damn Vulnerable Serverless Application
appsecco/dvcsharp-apiDamn Vulnerable C# Application (API)
george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…
george0papasotiriou/cve-2026-5432-graphql-batching-alias-confusion-sql-injectionDemonstrates a critical GraphQL batching alias-confusion SQL injection (CVE-2026-5432) with a vulnerable Node.js server and Python exploit for…
rootdirective-sec/cve-2026-55255-labLocal Docker lab for reproducing CVE-2026-55255, an IDOR vulnerability in Langflow's Responses API. Validates cross-user flow execution in vulnerable…
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
rootdirective-sec/cve-2026-46645-analysis-labDocker-based lab for reproducing CVE-2026-46645, an authorization bypass in SQLAdmin's ajax_lookup endpoint. Includes vulnerable and patched targets,…
ronf98/cve-2024-11972-pocCVE-2024-11972 in Hunk Companion <1.9.0 allows unauthenticated attackers to exploit insecure REST API endpoints and install vulnerable plugins,…
shoucheng3/apache__dubbo_cve-2021-30180_2-7-9Exploit for CVE-2021-30180 targeting Apache Dubbo RPC framework, enabling remote code execution via crafted RPC requests in vulnerable versions.
5qu1n7/cve-2025-55817ChilliCream Nitro GraphQL version 28.0.13 is vulnerable to multiple Stored Cross Site Scripting (XSS) Vulnerabilities
ashiqrehan-21/mcp-inspector-cve-2025-49596MCP-Inspector-vulncheck is a Python script that checks if an MCP Inspector server is vulnerable to CVE-2025-49596. It tests whether the /sse endpoint…
mindpatch/simple-mavenDeliberately vulnerable C# API application for practicing web application exploitation and security testing. Includes Docker setup and documentation…