commix
commixproject/commixAutomated All-in-One OS Command Injection Exploitation Tool
exploitationpenetration-testingvulnerability-scanners+2
5.8k
commixproject/commixAutomated All-in-One OS Command Injection Exploitation Tool
godliveanton/cve-2026-61241Oracle OID LDAP Server Privileges Management Exploit
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
opensource-arrozconpollo191/cve-2026-41089-netlogon-rceScan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.
olizimmermann/s3dnsPassive DNS server that detects exposed cloud storage buckets (AWS S3, GCP, Azure) by resolving DNS requests, tracing CNAME chains, and flagging…
projectdiscovery/nucleiNuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling…
reddelexc/hackerone-reportsCurated collection of top HackerOne bug bounty reports organized by vulnerability type and program, with scripts to fetch, deduplicate, and rank…
squeeze440/cve-2026-73847-emlog-pocPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)
dinosn/cve-2026-71362-magento-labDocker lab reproducing CVE-2026-71362 Magento/Adobe Commerce account takeover via customer-session identity switch, with PoC and official-patch A/B/A…
4minx/cve-2026-72898Proof-of-concept exploit for CVE-2026-72898, an unauthenticated SQL injection in Metabase's password-reset endpoint. Forges an admin session for full…
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
iamthefrogy/frogy2.0Orbis is an full spectrum automated external attack surface intelligent toolkit.
boreas37/cve-2026-41452-pocCVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5
nsonaniya2010/subdomainizerA tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.
darklycn1976/cve-2026-19264CVE-2026-19264 - Critical unauthenticated path traversal to full instance takeover in Postiz (< 2.22.1). Technical writeup: decode-order bypass,…
polosss/by-poloss..-..cve-2026-15038-pocPoC exploit for CVE-2026-15038 in InfiniteWP Client WordPress plugin: bypasses authentication on Multisite, binds attacker RSA key, escalates to…
boxed-dev/vibe-coding-securityPre-launch security checklist for AI-generated apps (Lovable, v0, Bolt, Cursor). 69 checks covering Supabase RLS, exposed keys, and prompt injection.…