Tools

nabeelmkhan/cve-2026-78837

Proof-of-concept exploit for CVE-2026-78837, an unauthenticated SQL injection in AppNitro MachForm v30 allowing enumeration of database column names…

stvm8/cve-2026-2005_lab

Self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension, enabling privilege…

romain-deperne/cve-2026-33980

KQL Injection in adx-mcp-server via table_name parameter — CVSS 8.8

romain-deperne/cve-2026-32247

Cypher Injection in graphiti-core (getzep/graphiti) via unsanitized node_labels — CVSS 8.1

mbanyamer/llama-stack-0.4.0rc3-local-cve-2026-25211

Local proof-of-concept scanner that detects plaintext database passwords in llama-stack initialization logs, using regex pattern matching to identify…

emad-almousa/cve-2021-2175

Proof-of-concept exploit for CVE-2021-2175, an Oracle Database Vault metadata exposure vulnerability, demonstrating unauthorized access to sensitive…

xmyronn/cve-2026-7229-sqli

Proof of concept for authenticated SQL injection in Coaching Management System, demonstrating database dump via unsanitized complaintreply parameter.

cerberusmrxi/phpmyadmin-cve-2020-5504-exploit

Authorized SQL injection exploitation framework for CVE-2020-5504 in phpMyAdmin, featuring automated database enumeration, blind injection, proxy…

trailofbits/cvedb

CVE querying library and utility that uses a local store syncing directly to the National Vulnerability Database

kyos-public/keycloak-cve-2026-18963-hunt

Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database

trailofbits/not-going-anywhere

Intentionally vulnerable Golang programs exposing web, gRPC, and database/sql flaws for security training, vulnerability discovery, and remediation…

wapiti-scanner/wapiti

Web vulnerability scanner written in Python3

wattocyber/custom-oscp-tooling

OSCP-focused toolkit for read-only network, SMB, AD, DNS, web, and database enumeration; privesc scanning, hash identification, and…

ubitquity/metabase-setup-endpoint-sqli-fix

Fixes unauthenticated SQL injection in a setup endpoint by replacing raw JDBC queries with ORM parameterization and constant-time token validation.

aramosf/cve-2026-24031

Self-contained Python PoC for Dovecot SQL authentication bypass: logs in as any user without the real password and enumerates usernames on vulnerable…

0xblackash/cve-2026-72898

CVE-2026-72898

metthk/cve-2023-48084-revised

Python PoC exploiting time-based blind SQLi in Nagios XI to extract database contents, with multithreaded binary-search extraction and CLI…

decalage2/awesome-security-hardening

A collection of awesome security hardening guides, tools and other resources