Tools

sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

projectdiscovery/nuclei

Fast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…

gojue/ecapture

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.

rapid7/metasploit-framework

Open-source exploitation framework with modular payload, encoder, and auxiliary system for penetration testing, vulnerability validation, and…

zaproxy/zaproxy

Open-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

pranshuchittora/simvyn

Universal mobile devtool for Agents & Humans - control iOS Simulators, Android Emulators, and real devices from a single dashboard and CLI

abraxas/phpmyadmin-auth-plugin-unquoted

phpMyAdmin 5.2.3 - High - Remote - SQLi - auth plugin identifier unquoted

abraxas/cakephp-collate-sqli

CakePHP 5.4.2 - High - Remote - SQLi - COLLATE collation is a raw SQL fragment

abraxas/stirling-h2-import-leftover

Stirling-PDF v3.2.0 - Critical - Remote - H2 RUNSCRIPT leftover - CREATE OR REPLACE ALIAS import-database

tc4dy/cve-2026-58048-poc-exploit

👾 CVE-2026-58048 – cPanel Root SQL Execution Toolkit (CVSS 9.4) | Full Red/Blue Team Toolkit suite for unpatched cPanel & WHM 11.x. 2 tools: Safe…

scorpioneslabs/mssqlpwner

Advanced MSSQL penetration testing tool for lateral movement, command execution, NTLM relay, and brute-force attacks via linked servers and multiple…

wapiti-scanner/wapiti

Web vulnerability scanner written in Python3

4minx/cve-2026-48842

Python PoC for CVE-2026-48842, a pre-auth SQL injection in Roundcube's virtuser_query plugin. Confirms the flaw via time-based differential and…

qucklecrabik/cve-2026-23921

Proof-of-concept exploit for CVE-2026-23921, a time-based blind SQL injection in Zabbix API via the sortfield parameter, enabling data extraction…

34zy/cve-2026-72898

Python exploit for CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint that creates admin accounts and extracts…

repo4chu/cve-2026-78804_dolibarr_authenticated_sql_injection

The action responsible for setting the per-warehouse stock alert threshold (`seuil_stock_alerte`) accepts user-controlled input and later…

galisko/cve-2025-24799

Unauthenticated SQL injection exploit for GLPI versions before 10.0.18, enabling database enumeration, credential extraction, and API token…