CVE-2026-106173 – FortiSIEM phQueryMaster RCE (CVSS 9.8) | Red/Blue Team suite for unpatched FortiSIEM 7.5.0. 2 tools: Full Exploit (multi-primitive RCE, reverse shell, persistence, creds, readback...

C2 using gopacket/pcap for RCE on Windows and Linux - MeHungr/doodlebob

Android 系统安全架构、漏洞风险分析与防御实践. Contribute to reeseq310612/android-security-reports development by creating an account on GitHub.

Disney+ clone built with Next.js, TypeScript, and Neon Postgres — used as a deliberately vulnerable target app (SQL injection, stored XSS, hardcoded secret) to demo a DevSecOps CI/CD security pipel...

A reflected XSS scanner I built for my cybersecurity internship at Syntecxhub that crawls pages, injects payloads, and reports unescaped reflections, tested against a local vulnerable Flask app. - ...

PHP2Shell — PHP session upload-progress RCE & memory disclosure research (CVE-2026-109618 / CVE-2026-109619): exploits, Docker lab, scanner and tooling. Authorized testing only. - memuratoz...

Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3 - vperetti/php-cve-2026-109618-109619-backports

Kit para diagnosticar y corregir **PHP2Shell** (CVE-2026-109618 y CVE-2026-109619, RCE sin autenticación en PHP 5.4 a 8.5.11) en servidores Linux de clientes. - bitforce23-max/PHP2Shell

Contribute to shahzodislomov/Burp-MCP development by creating an account on GitHub.

Advanced Pre-Auth RCE Exploit for PHP session.upload_progress (CVE-2026-109618 & 109619) by Farhad Hosen. - FarhadHosen101/PHP2Shell-CVE-2026-109619

PHP2SHELL VULNERABILITY SCANNER AND EXPLOIT . Contribute to Mr-Destroyer/PHP2SHELL development by creating an account on GitHub.

CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SIZE_CAP = 2^24 makes RCE structurally unreachable. - ikow/brotli2crash

Localhost-only Docker lab reproducing PHP 2026-10 memory-safety CVEs (CVE-2026-109618/-109619) via official regression tests. Differential vulnerable-vs-fixed, no exploit code. - ChangWeiHong/php-c...

WordPress vulnerability scanner: fingerprints core, theme and plugins, maps versions to CVEs (NVD + WPScan) and generates an HTML risk report with remediations. - XavierPonsM/wp-vuln-scanner

Downloads for Watchtower, a network vulnerability scanner for macOS. By PixelLabs, pixel-labs.dev/watchtower - 0100-1010/watchtower-releases

Magento CE <= 1.9.0.1 - Authenticated Remote Code Execution - l0lsuit/magento-ce-1.9-authrce

Step-by-step walkthrough of PHP2Shell (TryHackMe): leaking memory to defeat ASLR and achieving unauthenticated RCE through a PHP runtime bug, not an app vulnerability. Includes mistakes made, detec...

Contribute to MorFix/php-rce-exploitation development by creating an account on GitHub.

Static & dynamic analysis of a Windows dropper with ATT&CK mapping and YARA/Sigma detections - Maysalk/desertshade-malware-analysis

Contribute to kjayavardhan02/SecHedr-Burp-Extension development by creating an account on GitHub.

Fleet-wide audit, remediation & IOC scan for CVE-2026-109618/109619 (php2shell). Finds every PHP build ea-php/alt-php/lsphp not just `php -v`. Read-only, no exploit code. - Magicalname/php2...