Roundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC — version detect, virtuser plugin, login probe. https://pocbit.org - pocbit/CVE-2026-48842

ROP chain filter & shellcode helper for exploit developers — built for OSED/OSCE3 - Tendarkness/roprop

This contains a number of shell functions that may be of use. The intention is for the root of this repository to be cloned to an area in a user's home directory. Then `shellFunctionSetup.s...

Contribute to nikul0022/Penetration-Test-SNMP-Exploitation-on-Windows-Server-2008-R2 development by creating an account on GitHub.

Professional TryHackMe Smol walkthrough documenting WordPress enumeration, jsmol2wp LFI, wp-config disclosure, PHP backdoor analysis, RCE, reverse-shell access, credential-based lateral movement, S...

Hands-on cybersecurity CTF labs covering SQL injection, SSRF, XSS, MITM, race conditions, path traversal, authorization bypasses, OS command injection, and authorized network security testing. - si...

Hands-on cybersecurity and CTF labs covering email forensics, Windows Registry and Shimcache analysis, PST/OST triage, mobile verification, authorized OSINT, partition recovery, SQL injection, SSRF...

Zero-Trust API Vulnerability Scanner for automated API security analysis. - tanishqueagrawal/SentinelAPI

Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/de...

Unauthenticated authorization bypass in Customer Reviews for WooCommerce ≤ 5.120.0: holders of a public /cusrev/{formId}/ review link can POST cr_local_forms_submit with arbitrary Media Library att...

Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit). - murr...

Known-vulnerability scanner for npm, Go and Python lockfiles, against the real OSV.dev database. Real CVSS v3.1 scoring, waivers, SARIF. Python, MIT. - sriharifortitude/vulnlock

Contribute to MaestraSoprano/SSRF3r development by creating an account on GitHub.

web hacking sharp-tool kit. XSS, SSRF, IDOR... Contribute to Pabl0l/jack-sparrow development by creating an account on GitHub.

CVE-2026-43499 (GhostLock) port: working root on the Huawei MatePad Pro MRX-W09 (Kirin 990, EMUI 11, Linux 4.14.116) - disassembly-proven write primitive, perf cred leak, and a source-derived HKIP ...

Contribute to reewardius/nuclei-fast-templates development by creating an account on GitHub.

Bug fixes for Smoothwall Express 3.1's DHCP static-assignments GUI (garbled IP/MAC display, a related stored-XSS, and stale Active status), found while running the DHCP-WoL mod. - petter5/s...

End-to-end reproduction and cross-layer detection of CVE-2026-53576, the unauthenticated RCE in Kestra — taken past the base PoC to show how a common Docker-socket misconfiguration turns container-...

Automate OSINT data collection and case management with machine-driven monitoring and human-in-the-loop decision making. - impressionistic-permeation7619/watchdog

A powerful, containerized Web Vulnerability Scanner featuring industry-standard security tools (Nmap, Nikto, SSLScan, TestSSL). Fully packaged into a self-contained Docker deployment that sets up i...

Modular pentest framework — 195+ modules, 14k Nuclei templates, KEV/ExploitDB, Burp-lite proxy, Flask UI, SARIF/CI, Termux-native - shadowboykay/omnistrike