carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

HiddenSteps

Core crates — implementation status This is the honest, current-state complement to docs/design/02-system-architecture.md's target module map. It says what's actually built, what's verified against a real backend vs. a mock, and what's still genuinely missing — not what's planned that's...

armadito-av

Armadito core Armadito is an open-source antivirus. This repository contains Armadito core library, daemon and service. Copyright C Teclib', 2015, 2016 Project home : http://www.teclib-edition.com/teclib-products/armadito-antivirus See Online documentation at :...

boxlambda

Acerca de BoxLambda BoxLambda es un proyecto híbrido hardware-software que crea un microordenador casero de estilo retro basado en FPGA. El objetivo es crear un entorno de espacio aislado para experimentar con software y gateware FPGA. Configuración Física La configuración física. Características...

SpringFramework_CVE-2022-22965_RCE

SpringFrameworkCVE-2022-22965RCE SpringFramework Remote Code Execution Vulnerability CVE-2022-22965 Vulnerability Reproduction Environment root@kitploit: docker pull vulfocus/spring-core-rce-2022-03-29 docker run -d -p 8090:8080 --name springrce -it vulfocus/spring-core-rce-2022-03-29 Write...

citrix-2025

Detection Script for Citrix NetScaler appliances Author: NCSC-NL !WARNING Some of these checks are meant to hunt for compromises, while other checks verify if you are compromised. Disclaimer These scripts are provided without any guarantees regarding its effectiveness. The detection capabilities ...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

arduino-pico

Arduino-Pico Raspberry Pi Pico Arduino core, for all RP2040 and RP2350 boards This is a port of Arduino to the RP2040 Raspberry Pi Pico processor and RP2350 Raspberry Pi Pico 2 processor. It uses the bare Raspberry Pi Pico SDK and a custom GCC 14.3/Newlib 4.5 toolchain and supports ARM and RISC-V...

NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text vulnerability discovered by ? in WordPress Npm paella-core versions 1.50.6...

ROOT-APP-MAVEN-CVE-2025-41232 CVE-2025-41232 in org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2025-41232 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

PulseAPK-Core

PulseAPK 🌍 Languages English | Deutsch | Español | Français | עברית | 한국어 | Беларуская | Suomi | Latviešu | Eesti | Lietuvių | Čeština | Slovenčina | Magyar | العربية | Português | Русский | Українська | 中文 PulseAPK es una GUI de nivel profesional para ingeniería inversa de Android y análisis de...

ftw

Marco para pruebas de WAF FTW Propósito Este proyecto fue creado por investigadores de ModSecurity y Fastly para ayudar a proporcionar pruebas rigurosas para las reglas de WAF. Utiliza el OWASP Core Ruleset V3 como referencia para probar reglas en un WAF. Cada regla del conjunto se carga en un...

CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PHP Code Execution — WordPress Core Software: WordPress Core ≤ 7.0.2 all versions prior to 7.0.3 CVSS: 8.9 High CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation Authentication Required: None Pre-Auth User Interaction...

CVE-2026-64638-POC

CVE-2026-64638 — XSS2Shell Pre-Authentication Reflected XSS → Remote Code Execution in WordPress Core ⚠️ DISCLAIMER: This repository is for authorized security research and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Unauthorize...

Safer_PoC_CVE-2022-22965

SaferPoCCVE-2022-22965 A Safer PoC for CVE-2022-22965 Spring4Shell Functionality Creates a file called CVE2022-22965exploited.txt in the tomcat directory 'webapps/ROOT' Option user argument to change the output directory Exploit validation is performed by requesting the output .txt file, dependin...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

CVE-2025-55315-PoC-Exploit

CVE-2025-55315 Pentest Tool HTTP Request Smuggling Exploitation Tool for ASP.NET Core Kestrel ⚠️ LEGAL WARNING THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY! Use ONLY on systems you own or have explicit written authorization to test Unauthorized access to computer systems is ILLEGAL Tool...

log4j-test

Simple Example showing CVE-2021-44228 in action Explanation To reproduce this issue, I am removing the transitive dependency for logging from SpringBoot. Instead, I am bringing in spring-boot-starter-log4j2 spring-boot-starter-log4j2 brings in log4j-core which has the remote code exploit RCE...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...