GEO.RITM REST API Auth Bypass Info Disclosure

The vulnerability of the software interface REST API of the GEO.RITM software lies in the lack of authentication when accessing the function for retrieving object attributes. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...

VulnerableSpringDataRest

Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...

POC-CVE-2026-63030-CVE-2026-60137-

PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137 -red?style=for-the-badge 📌 Overview WP2Shell is a critical exploit chain in WordPress Core source code that allows a remote unauthenticated attacker to gain full control of the server Full Server Takeover / RCE. The exploit chain combines two securi...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms Unauthorized Form Publication Authenticated Contributor+ Authorization Bypass to Publish Any Draft Form in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-11991 CVSS Score| 6.2 — Medium CVSS Vector|...

Argos

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture +-----------------------+ | Frontend React 19 | | Vite +...

burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i, --issue-type-id String...

Cortex

Cortex tries to solve a common problem frequently encountered by SOCs, CSIRTs and security researchers in the course of threat intelligence, digital forensics and incident response: how to analyze observables they have collected, at scale , by querying a single tool instead of several? Cortex, an...

traccar

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

BurpSuite_Pro_v1.7.37

Update burpsuiteprov2.0beta.jar Burp Suite 2.0 beta is now available for Professional users. This is a major upgrade with many new features, including: A new crawler that is able to automatically handle sessions, detect changes in application state, handle multiple login captures, and process...

FACT_core

The Firmware Analysis and Comparison Tool FACT Contents Why FACT? Setup Usage Documentation Contribute Additional plugins Analysis Import/Export Presentations Social Acknowledgments License Why FACT? Firmware analysis can be used to achieve several interesting goals. Chief among those are...

CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-18366 Severity| 🔴 CRITICAL CVSS 9.8 Plugin| Events Manager for...

wp2shell-rce

WP2Shell RCE An assessment and scanning utility designed to detect exposure to the WP2Shell exploit chain in WordPress Core installations across single endpoints or large target lists. ⚠️ Disclaimer Only scan systems you own or are authorized to assess. Unsanctioned scanning or testing of...

CVE-2025-32044

CVE-2025-32044 — Moodle Unauthenticated REST API User Data Exposure Stack Trace Args Leak → Names, Emails, Password Hashes Overview CVE-2025-32044 is a high-severity CVSS 7.5 unauthenticated information disclosure vulnerability in Moodle LMS 4.5.0 through 4.5.2. The vulnerability lies in Moodle's...

wp2shell

wp2shell Pre-authentication Remote Code Execution against WordPress Core. Chains CVE-2026-60137 SQLi in authornotin / authorexclude parameter of WPQuery with CVE-2026-63030 REST API batch-route confusion for unauthenticated RCE. Affected Versions Range| Status ---|--- = 6.8.5| Not affected no bat...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data. Authorization...

wordpress-cve-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE Pre-authentication, unauthenticated, no plugins required. Works against a stock WordPress install via the REST API batch endpoint. | ---|--- CVE| CVE-2026-63030 route confusion → RCE + CVE-2026-60137 SQLi GHSA| GHSA-ff9f-jf42-662q ·...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

REST-Attacker

REST-Attacker REST-Attacker is an automated penetration testing framework for APIs following the REST architecture style. The tool's focus is on streamlining the analysis of generic REST API implementations by completely automating the testing process - including test generation, access control...

cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection Overview wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to: 1. Reach an SQL injecti...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...