CVE-2026-87902
bhideki/cve-2026-87902Python PoC and scanner for CVE-2026-87902, a WordPress core path traversal leading to LFI and PEAR-based RCE, with WAF bypass and automated…
exploitationpayload-developmentpenetration-testing+6
2
bhideki/cve-2026-87902Python PoC and scanner for CVE-2026-87902, a WordPress core path traversal leading to LFI and PEAR-based RCE, with WAF bypass and automated…
ekkoo-z/cve-2019-18935-bypasswafExploit for CVE-2019-18935 (Telerik UI) with WAF bypass via encrypted cookie payload injection and custom memory shell deployment.
z3rodayhacks/cve-2026-63030-cve-2026-60137Pre-auth RCE proof-of-concept chaining a WordPress REST batch API auth bypass with WP_Query SQL injection to dump hashes, add admin users, or plant a…
joelvaiju/react2shell-cve-2025-55182-pocPython PoC for CVE-2025-55182 (React2Shell) RCE in Next.js/React Server Components with dynamic WAF bypass padding for authorized security testing.
kannthu/cve-2021-44228-apache-log4j-rceProof-of-concept exploit for CVE-2021-44228 (Log4Shell) with JNDI injection payloads, WAF bypass techniques, and passive scanning integration for…
mzfr/liffyLocal file inclusion exploitation tool
waf-bypass-maker/waf-community-bypassesCurated CSV collection of community-sourced Web Application Firewall bypass payloads for testing and validating WAF protections.
harness-security-labs/cve-2025-55182-checkerMulti-technique vulnerability detector for CVE-2025-55182 in React/Next.js applications. Tests gadget chains, RCE payloads, and WAF bypass variants…
redsection/pfuzzModular WAF bypass fuzzer with multi-threading, request manipulation, and payload encoding for red team web application testing.
edr4/xss-bypass-filtersCurated XSS payload collection and filter-bypass cheat sheet: WAF-specific evasion, JS/HTML injection vectors, encoding tricks, DOMPurify and…
wafpassproject/wafpassAnalysing parameters with all payloads' bypass methods, aiming at benchmarking security solutions like WAF.
ammarion/waf-detector🛡️ High-performance WAF & CDN detection tool. Identify protection layers (Cloudflare, Akamai, AWS, Fastly, and more), run effectiveness and…
sech0us3/waf-checkerAutomated WAF assessment tool that detects firewall vendors, tests 19 attack categories with advanced evasion payloads, and provides color-coded…
michele0303/undetected-httpxStop getting 403 Forbidden. A specialized httpx-like toolkit for WAF evasion.
matrixtm/mhddosBest DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
coreruleset/corerulesetGeneric attack detection rule set for web application firewalls, protecting against OWASP Top Ten and common vulnerabilities with minimal false…
blacklanternsecurity/trevorsprayModular password sprayer with SSH proxy rotation, MFA bypass, and domain recon. Supports O365, ADFS, OWA, Okta, Cisco VPN. Automates credential…
yiliufeng168/cve-2022-31813Demonstrates CVE-2022-31813 Apache HTTP Server bypass using X-Real-IP header manipulation to evade access controls, with a Docker-based test…