Tools

crypticrig3l/havij

Native Linux SQL injection scanner with classic Havij UI, supporting error-based, union-based, boolean blind, and time-based detection,…

cerberusmrxi/phpmyadmin-cve-2020-5504-exploit

Authorized SQL injection exploitation framework for CVE-2020-5504 in phpMyAdmin, featuring automated database enumeration, blind injection, proxy…

candisexterior171/cve-2026-57827

Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.

shenril/sitadel

Modular web application security scanner with fingerprinting (server, CMS, WAF, CDN) and attack modules (SQLi, XSS, RFI, brute-force) for automated…

ghostpels/cve-2026-18366

Unauthenticated privilege-escalation PoC for WordPress Events Manager < 7.4.1; discovers colliding post/user IDs and escalates targets to…

yora1928/cve-2026-15748

Scans WordPress Forminator for CVE-2026-15748 unauthenticated RCE. Detects vulnerable sites, crawls forms, extracts nonces, runs safe upload tests.

davkharrr/cve-2026-19478-poc

Proof-of-concept exploit for unauthenticated remote code injection in GitLab's GraphQL API, using crafted queries to modify or delete public projects…

h4zaz/cve-2026-8794

Username Enumeration via Authentication Timing Side-Channel in PaperCut NG

portswigger/param-miner

Burp Suite extension that discovers hidden, unlinked parameters using advanced diffing and binary search, enabling detection of web cache poisoning…

metthk/cve-2023-48084-revised

Python PoC exploiting time-based blind SQLi in Nagios XI to extract database contents, with multithreaded binary-search extraction and CLI…

g0d150ne/xss2shell

Exploits WordPress pre-auth XSS (CVE-2026-64638) to achieve remote code execution, installing an AES-encrypted backdoor webshell with persistence,…

murrez/cve-2026-65891

Authenticated proof-of-concept scanner for the Joomla JCE rename vulnerability; fingerprints vulnerable versions, uploads hidden markers, verifies…

mr-leonardogomes/xss2shell-cve-2026-64638

WordPress security scanner that fingerprints versions, detects reflected XSS across multiple targets concurrently, and supports an authenticated…

gagaltotal/cve-2026-60004-poc-gitea

CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection

imbas007/cve-2026-64638-poc

CVE-2026-64638: WordPress Pre-auth XSS → RCE (XSS2Shell) PoC

johenlastgen-jlg/cve-2026-11961

Multi-threaded exploit for CVE-2026-11961 in WordPress User Registration; detects vulnerable versions and creates admin accounts, with batch…

abdullahmaqbool22/cve-2026-60137-wordpress-core-sql-injection-poc

Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`),…