Tools

sromanhu/totalcms-arbitrary_file-upload--xss_steal_cookies---totaldepot

TotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting (XSS) Stored and also stealing session cookies

vognik/cve-2026-26980

Unauthenticated SQL injection exploit for Ghost CMS Content API (CVE-2026-26980); dumps database tables from SQLite/MySQL with active/passive checks…

kaandemir993/redline-stealer-c2-defender-bypass-payload-analysis

"Reverse engineering analysis of RedLine Stealer, a .NET-based info-stealer that uses C2 domains (198.46.86.63, tempuri.org), Windows Defender…

lukebaggett/google_socks

A proof of concept demonstrating the use of Google Drive for command and control.

francesc-h/firebase

Exploiting misconfigured firebase databases

thespeedx/tbomb

This is a SMS And Call Bomber For Linux And Termux

mitrecnd/whodat

Pivotable Reverse WhoIs / PDNS Fusion with Registrant Tracking & Alerting plus API for automated queries (JSON/CSV/TXT)

jas502n/grafana-cve-2021-43798

Grafana Unauthorized arbitrary file reading vulnerability

otterhacker/m365pwned

Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens

ttffdd/xbadmanners

Tool for CVE-2018-16323

invicti-security/web-inf-path-trav

Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications

bibi1959/cve-2019-15514

telegram bug that discloses user's hidden phone number (still unpatched) (exploit included)

ac3lives/kyocera-cve-2022-1026

An unauthenticated data extraction vulnerability in Kyocera printers, which allows for recovery of cleartext address book and domain joined passwords

jas502n/vmware_vcenter

VMware vCenter(Unauthenticated)