Scanner-and-Patcher

Scanner and Patcher Overview: The Scanner and Patcher project is built as part of the AlphaSecure framework, which has been presented and published at ACM IC3 2024 under the title AlphaSecure: A State-of-the-Art Framework for Web Application Vulnerabilities Detection and Patch Recommendation Usin...

PwnXSS

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 pip install bs4 requests pip install requests python 3.7 Commands: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help Usage Basic usage: python3 pwnxss.py -u...

xsshunter

DEPRECATED - TRY THE NEW EXPRESS VERSION See here for more info: https://github.com/mandatoryprogrammer/xsshunter-express XSS Hunter Source Code This is a portable version of the source code running on https://xsshunter.com. It is designed to be easily-installable on any server for security...

sobelow

Sobelow Sobelow is a security-focused static analysis tool for Elixir & the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent the introduction of a number of common vulnerabilities...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

CVE-2026-66293

The Saxy library (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because the Saxy.Encoder fails to neutralize the -- sequence within XML comments. Specifically, the escape_comment/2 function fails to escape interior -- or full --> sequences, allowing an attacker to prematurely cl...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2026-97045

A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces,...

CVE-2026-117621

A flaw was found in Jenkins. This vulnerability allows a Cross-Site Scripting XSS attack because the URLs displayed in the workspace browser for files and directories are computed directly on the build agent. An attacker who controls an agent process can exploit this flaw to inject and execute...

CVE-2026-117613

A flaw was found in Jenkins. The application does not restrict the types of collection elements during deserialization when processing configuration data. An authenticated attacker with item configuration permissions can exploit this vulnerability by submitting a crafted configuration XML file,...

CVE-2023-0214

SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

paperweight

Paperweight website Marketing site for Paperweight. Development Install deps from the repo root, then run Next.js in this package: pnpm -C website install pnpm -C website dev Production build pnpm -C website build pnpm -C website start Environment variables This site has two server-side API route...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. ezXSS is a tool that is designed to help find and exploit cross-site scripting XSS vulnerabilities. One of the key features of ezXSS is its ability to identify and exploit blind XSS...

CVE-2023-29489

CVE-2023-29489 Mass Scaning vulnerability in Cpanel XSS KALI LINUX sudo pip install BeautifulSoup sudo pip install shodan sudo pip install pystyle git clone https://github.com/0-d3y/CVE-2023-29489.git cd CVE-2023-29489 python cve202329489.py TERMUX pkg install BeautifulSoup pkg instaal shodan pkg...

DeimosC2

DeimosC2 Deimos is in: DEPRECATED DeimosC2 is no longer maintained and has a known XSS vulnerability CVE-2025-26244. Thanks to JaRm222 for identifying the vuln and notifying us. His writeup of the vuln can be foundhere. DeimosC2 is a post-exploitation Command & Control C2 tool that leverages...

traxss

Traxss Automated Vulnerability Scanner for XSS | Written in Python3 | Utilizes Selenium Headless Forks DEMO Background Traxss is a Hacktoberfest Project! If you are looking for a place to make contribute, please feel free. Traxss is an automated framework to scan URLs and webpages for XSS...

FOQUZ Platform XSS

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...