Reflected Cross-Site Scripting (XSS) vulnerability in itsourcecode Banking Management System V1.0 via the page parameter in /navbar.php - moreorless403-star/Banking-Management-System-XSS-Vulnerability

A single-file Python tool that fingerprints a target, verifies the confirmed session.upload_progress session-file poisoning primitive, and produces a coarse exposure verdict — without shipping a we...

CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework) - Is4yev/php2shell-poc

CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab - wakemeiflose/php2shell

Contribute to junaire/CVE-2026-109618-exploit development by creating an account on GitHub.

Contribute to Ademking/php2shell-nuclei-templates development by creating an account on GitHub.

Autonomous Local Vulnerability Scanner, Fast CVE Search Engine & Dependency Audit Plane for AI Coding Agents (Claude Desktop, Cursor) - johannschiffer/cvesentry-mcp

Four hands-on web app attack PoCs — Session Hijacking, Session Fixation, Stored XSS & CSRF — BIA CSEH Capstone - omkarsawant94/web-app-security-poc

PHP session.upload_progress: cross-request use-after-free in the pre-RINIT serializer state (claimed CVE-2026-109618 / CVE-2026-109619 — NOT registered in MITRE/NVD). PHP 8.x, cli-server, gdb proof...

Contribute to nooralshater/XSS- development by creating an account on GitHub.

A curated collection of hands-on cybersecurity CTF labs covering Citrix Bleed, PAN-OS GlobalProtect, Fortinet SSL VPN, Cisco ASA/IOS XE, F5 BIG-IP, Pulse Secure, VMware vCenter/ESXi, and Oracle Web...

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), ra...

Defensive awareness site dissecting the php2shell PHP zero-day (CVE-2026-109618 / CVE-2026-109619): why it's critical, who's affected, and how to patch in time. - 0-draft/php2shell-anatomy

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8....

Custom Python-based HTTP command-and-control (C2) framework developed for a collegiate red-team competition, featuring multi-agent session management, remote command execution, and automated deploy...

File and URL analyzer with static and dynamic analysis capabilities - teddy-williams/tollgate-defender

ADXPL-Forge (AXF) — Active Directory exploitation framework. 219 modules across 25 categories for AD pentest and Red Team operations. - mrhenrike/ADXPL-Forge

Use this to enforce W^X in gvisor or docker containers - GlassROM/seccomp-mdwe

Independent verification lab + PoCs: PHP session.upload_progress pre-auth RCE chains (CVE-2026-109618/109619) - mnk-works/php2shell-verify

Pocket proof-of-concept and lab materials for PHP2SHELL remote code execution research. - KarimUD7/RCE-POCKET-POC-for-PHP2SHELL

php2shell (CVE-2026-109618/CVE-2026-109619) emergency patches for old PHP 5.6/7.x/8.0/8.1 — official + community backports, enhanced universal patch keeping file uploads & progress bars. Fo...