recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

CVE-2026-109332

The Network-AI (npm network-ai) package versions before 5.15.2 is vulnerable to a CORS Origin Validation Error within the McpSseServer._handleRequest function in lib/mcp-transport-sse.ts. The root cause is the reflection of localhost Origins into the Access-Control-Allow-Origin header regardless ...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

ApiHunter

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. 🎯 ApiHunter 📺 Video Demo Click to watch the full demo on YouTube 🖥️ Desktop App...

CorsMe

What is CorsMe ? A cors misconfiguration scanner tool based on golang with speed and precision in mind ! Misconfiguration type this scanner can check for Reflect Origin checks Prefix Match Suffix Match Not Esacped Dots Null ThirdParties Like = github.io, repl.it etc. Taken from Chenjj's github re...

CVE-2019-9580

CVE-2019-9580 - StackStorm exploiting CORS null origin to gain RCE Prior to 2.10.3/2.9.3, if the origin of the request was unknown, we would return null. null can result in a successful request from an unknown origin in some clients. Allowing the possibility of XSS style attacks against the...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – CORS Misconfiguration Leading to Authenticated Data Exposure 📌 Advisory Reference CVE ID: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 Vendor: karnop Product: realtime-collaboration-platform Severity: HIGH CVSS 7.4 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 🧠 Vulnerability...

whatsapp-mitd-mitm

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research 01 on remotely exploiting Man-in-the-Disk MitD vulnerabilities on WhatsApp for Android. As discussed in our blog post, the code and accompanying scripts found here, were used ...

CORStest

CORStest A simple CORS misconfiguration scanner Based on the research ofJames Kettle CORStest is a quick & dirty Python 3 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following...

corsair_scan

Welcome to Corsairscan Corsairscan is a security tool to test Cross-Origin Resource Sharing CORS misconfigurations. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. If this is not...

Corsy

Corsy CORS Misconfiguration Scanner Introduction Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations. Requirements Corsy only works with Python 3 and has just one dependency: requests To install this dependency, navigate to Corsy directory and execute...

of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

dorkX

dorkX Pipe different tools with google dork Scanner Version 1.0 Install zoid@MSI /dorkX git clone https://github.com/ethicalhackingplayground/dorkX zoid@MSI /dorkX cd dorkX zoid@MSI /dorkX go build dorkx.go zoid@MSI /dorkX go build corsx.go zoid@MSI /dorkX go build csrfx.go zoid@MSI /dorkX go bui...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introduction: TheftFuzzer is a tool that fuzzes Cross-Origin Resource Sharing implementations for common misconfigurations. Usage: python theftfuzzer.py -d 'http://example.com/api/data' Help: python...

LightRAG <= 1.5.3 - Credentialed CORS Wildcard

LightRAG = 1.5.4 contains a broken access control vulnerability caused by default CORSORIGINS= with allowcredentials=True in lightragserver.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user. id: CVE-2026-61736 info: name: LightRAG = 1.5.3 -...

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS Exploit Author: emirhanerdogu Vendor Homepage https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html Software Link...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...