#1
modelcontextprotocol/inspectorInspect, debug, and visually test Model Context Protocol (MCP) servers from a web UI, CLI, or TUI, with tool/resource exploration, request logging,…
abraxas/vaultwarden-ip-header-spoofVaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT
abraxas/spark-rest-auth-bypassApache Spark 4.2.0 - High - Remote - Privilege leftover - standalone REST ignores spark.authenticate
abraxas/sonic-gnmi-noauthDocuments and reproduces a fail-open authentication flaw in SONiC gNMI where an empty UserAuth map allows unauthenticated gNMI Set and gNOI writes,…
abraxas/phpmyadmin-webauthnphpMyAdmin 5.2.3 - High - Remote - 2FA skip - WebAuthn ceremony can be skipped
abraxas/phpmyadmin-config-set-2faphpMyAdmin 5.2.3 - High - Remote - 2FA - config/set clears two-factor
abraxas/openmeetings-soap-otp-skipApache OpenMeetings 9.1.0 - High - Remote - 2FA skip - SOAP/REST password login skips TOTP
abraxas/openmeetings-remember-me-passwordApache OpenMeetings 9.1.0 - High - Remote - ATO - remember-me cookie replay authenticates without password
abraxas/nextcloud-federated-ocm-tokenNextcloud 35.0.0 — federated share secret is an unscoped app password for the sharer's whole Files tree
abraxas/lago-invite-atoProof-of-concept lab demonstrating a critical Lago GraphQL acceptInvite authentication bypass that enables cross-organization account takeover via…
abraxas/hyperswitch-unsigned-webhookProof-of-concept for an unauthenticated Hyperswitch Worldpayxml webhook flaw (CWE-345/306) that forges SETTLED XML to mark payments succeeded without…
abraxas/element-fragment-guestElement Web v1.12.29 - High - Remote - Session - fragment guest creds wipe a real session before whoami
abraxas/cve-2026-59358CVE-2026-59358에 대한 개념 증명(Proof-of-concept) 랩 및 익스플로잇 클라이언트로, Cloud Foundry UAA가 사용자 PKCE 토큰을 client_credentials Bearer로 재사용하여 권한 있는 클라이언트 토큰을 발급하는…
abraxas/cve-2026-5430Disclosure pack and Python PoC for CVE-2026-5430, a JWT algorithm-confusion flaw in WSO2 API Manager 4.5.0 enabling unauthenticated admin account…
abraxas/cve-2026-13447Proof-of-concept exploit for CVE-2026-13447, a critical authentication bypass in the WordPress MStore API plugin via forged Firebase JWT tokens, with…
max-rh/sshelfFast terminal UI for your SSH hosts: fuzzy-search and connect in two keystrokes, dual-pane SFTP file transfer, and background port forwarding. Keeps…
bert-janp/entratraceMicrosoft Entra ID를 대상으로 하는 공격 도구의 관찰 가능한 API 엔드포인트와 사용자 에이전트를 문서화하여 탐지 엔지니어링 및 사고 대응을 지원하는 방어 연구 도구입니다.
