Web vulnerability scanner. Contribute to Xuxu1020/bobscan development by creating an account on GitHub.

Contribute to 0x00phantom-hat/CVE-2026-11991-Exploit development by creating an account on GitHub.

漏洞扫描智能体. Contribute to bear561/vuln-scan-agent development by creating an account on GitHub.

End-to-end malware analysis reports, extracted IOCs, and custom YARA detection rules developed in an isolated lab (FLARE-VM / REMnux). Includes WannaCry, trojans, and malscripts. - R3DN1GHT2005/Mal...

This repository contains my detection rules for all kinds of malware and suspicious software. - ilyas7/yara-rules

Professional-grade modular Android 12+ penetration testing framework — 10 modules: Recon, Payload, Installer, C2, PrivEsc, Persistence, Exfiltration, MITM, Automation, Reporting - UsamaMatrix/Andro...

Aurelius M5 demo — Maven project with a deliberately outdated log4j-core for the log4shell-bump patch runner to fix - aureliusgovenai/m5-log4shell-demo

Demo: leaf app depending on transdep-demo-service-lib (2 hops from a vulnerable log4j-core dep in transdep-demo-util-common). Test target for the transitive-dependency gap in vuln-remediation-agent...

Bifrost Finance — stored XSS via backend database leading to one-click wallet drain. Submitted via Immunefi. - ChristopherPatrickKuntz/bifrost-xss-disclosure

CRLF Email Header Injection in Plunk via raw MIME construction — CVSS 8.5 - romain-deperne/CVE-2026-34975

OS Command Injection in KubeAI via Model URL in Ollama startup probe — CVSS 8.7 - romain-deperne/CVE-2026-34940

Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php — CVSS 7.5 - romain-deperne/CVE-2026-33715

PortSwigger Web Security Academy — Advanced Track. Hands-on exploitation of SSRF, Insecure Deserialization, and SSTI, with full PDF report and PoC screenshots. - itsmariamfatima/week-4-websec-w01-a...

Contribute to bright77777/cpanel-whm-authbypass-to-rce development by creating an account on GitHub.

Android Security Assessment and SAST Vulnerability Scanner based on OWASP MASVS & Mobile Top 5 - sravanibandreddy/android-application-penetration-testing

GhostJS — ZAP add-on that passively scans JavaScript responses for hard-coded secrets and discovers API endpoints, source maps, and cloud-storage URLs (port of Ghost-Js-Burp-Extension). - ArkhaMahn...

Arbitrary file read in mcp-atlassian via confluence_upload_attachment — CVE-2026-77262 / GHSA-p6hp-93wp-fh6p - romain-deperne/CVE-2026-77262

Reverse engineering and runtime analysis of the PackClient modular RAT framework, including protocol reconstruction, tooling, detections, and reproducible evidence. - ivanimmanuel-dev/PackClient

Cypher Injection in graphiti-core (getzep/graphiti) via unsanitized node_labels — CVSS 8.1 - romain-deperne/CVE-2026-32247

Full build-and-attack writeup for a self-hosted AD lab: domain controller setup, realistic domain population, then a full attack chain against it, SMB/LDAP enumeration, Kerberoasting and ASREPRoast...

Demo: company-standard logging/tracing util lib. Part of a 3-repo chain used to test transitive-dependency vulnerability handling in vuln-remediation-agent. Deliberately depends on a vulnerable log...