Tools

dmonst3r/wordpressmassexploiter

[discontinued] Mass exploiter of CVE-2015-1579 for WordPress CMS

slo-cyber-sec/cve-2026-78851

Technical advisory detailing an authenticated path traversal vulnerability in Grav CMS's Twig media_directory() function, enabling arbitrary…

mandatoryprogrammer/xsshunter-express

An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!

rabbitmask/weblogicscan

Automated vulnerability scanner for Oracle WebLogic Server, detecting historical CVEs including deserialization, SSRF, and arbitrary file upload with…

fox-it/citrix-netscaler-triage

Forensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…

4minx/cve-2026-32475

Proof-of-concept exploit for CVE-2026-32475, an unauthenticated arbitrary file upload in Elementor Pro leading to remote code execution. Includes…

bob-wentao/jsherp-user-info-idor

VulDB advisory: jshERP authenticated /user/info IDOR and password-digest replay after CVE-2025-60800

unpredictable21/cve-2026-75431_powerjob_jwt_key_predictable

Demonstrates a critical JWT signing key predictability vulnerability in PowerJob Server, allowing offline key derivation and token forgery for admin…

thekingofduck/burpfakeip

Burp Suite extension for spoofing IP addresses in HTTP requests, enabling testing of server-side IP restrictions and bypassing IP-based access…

ericmtzmtz/pwnproxy

An open, local-first security testing platform for pentesters, AI agents, CI/CD pipelines, and teams.

rajdave69/cve-2025-9974

Proof-of-concept exploit for CVE-2025-9974 targeting Nokia Beacon routers, demonstrating the vulnerability and providing a basis for security testing…

fankh/vulnerability-poc

CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security…

aryasahil96-manu/cve-disclosures

Curated repository of security advisories and vulnerability disclosures researched and reported by the author, including CVE-2025-70336, a stored XSS…

execution-py/cve-2026-9055

Defensive analysis of CVE-2026-9055, an unauthenticated privilege escalation in Amelia WordPress booking plugin. Provides root cause breakdown,…

spartanx-alejandro/cacti-cve-2023-39361

Exploit for CVE-2023-39361 in Cacti, a network graphing solution, demonstrating SQL injection vulnerability for educational and security testing…

bdblackhat/admin-panel-finder

Python script to discover admin panel URLs of websites, aiding in security reconnaissance and penetration testing.

sec-dan/wp2shell-scanner

Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)

e4zyy/project-cve-2026-65351

Browser resource exhaustion payload that crashes target systems via memory, GPU, audio, and rendering overload. Designed for authorized security…