Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/de...

Unauthenticated authorization bypass in Customer Reviews for WooCommerce ≤ 5.120.0: holders of a public /cusrev/{formId}/ review link can POST cr_local_forms_submit with arbitrary Media Library att...

Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit). - murr...

Known-vulnerability scanner for npm, Go and Python lockfiles, against the real OSV.dev database. Real CVSS v3.1 scoring, waivers, SARIF. Python, MIT. - sriharifortitude/vulnlock

Contribute to MaestraSoprano/SSRF3r development by creating an account on GitHub.

web hacking sharp-tool kit. XSS, SSRF, IDOR... Contribute to Pabl0l/jack-sparrow development by creating an account on GitHub.

CVE-2026-43499 (GhostLock) port: working root on the Huawei MatePad Pro MRX-W09 (Kirin 990, EMUI 11, Linux 4.14.116) - disassembly-proven write primitive, perf cred leak, and a source-derived HKIP ...

Contribute to reewardius/nuclei-fast-templates development by creating an account on GitHub.

Bug fixes for Smoothwall Express 3.1's DHCP static-assignments GUI (garbled IP/MAC display, a related stored-XSS, and stale Active status), found while running the DHCP-WoL mod. - petter5/s...

End-to-end reproduction and cross-layer detection of CVE-2026-53576, the unauthenticated RCE in Kestra — taken past the base PoC to show how a common Docker-socket misconfiguration turns container-...

Automate OSINT data collection and case management with machine-driven monitoring and human-in-the-loop decision making. - impressionistic-permeation7619/watchdog

A powerful, containerized Web Vulnerability Scanner featuring industry-standard security tools (Nmap, Nikto, SSLScan, TestSSL). Fully packaged into a self-contained Docker deployment that sets up i...

Modular pentest framework — 195+ modules, 14k Nuclei templates, KEV/ExploitDB, Burp-lite proxy, Flask UI, SARIF/CI, Termux-native - shadowboykay/omnistrike

Cloud dead-drop C2 channel plugin for Adaptix C2 v1.2. - stillbigjosh/adaptix-graph-c2

Fast reflected-XSS scanner with adaptive WAF-bypass engine - Rushikesh362/PawXssScanner

A Simple Vulnerability Scanner is a cybersecurity application that scans a system or website for common security weaknesses. It checks for issues such as open ports, weak configurations, outdated s...

A Simple Vulnerability Scanner is a cybersecurity application that scans a system or website for common security weaknesses. It checks for issues such as open ports, weak configurations, outdated s...

XSS vulnerability testing guide and findings from DVWA and PortSwigger labs - TEJASWANIANIMIREDDY/xss-penetration-testing

Self-hosted XSS Hunter Express - collect and manage XSS payloads - man715/xsshunter-express

针对 OnePlus Ace6 设备的 cve-2026-64560 复现. Contribute to Wangs-official/opace6-cve-2026-64560 development by creating an account on GitHub.

WP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix. - firasotoom85-droid/wp-plainview-auth-RCE-broken-cookie-to-sessio...