Mystikal

Mystikal macOS Initial Access Payload Generator Intended to be used with https://github.com/its-a-feature/Mythic Related Blog Post: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 Usage: 1. Install Xcode on build machine Required for Installer Package w/ Installer Plugin 2. Install...

CVE-2026-48204

CVE-2026-48204 — camel-mongodb-gridfs gridfs. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

CVE-2025-55182

CVE-2025-55182 Scanner & Exploiter !Warning This repository is intended for educational and research purposes only. Use the provided PoCs exclusively on systems you own or have explicit permission to test. Unauthorized access , exploitation, or misuse of any material in this repository is illegal...

legitify

Strengthen the security posture of your source-code management! Detect and remediate misconfigurations, security and compliance issues across all your GitHub and GitLab assets with ease 🔥 by Legit Security. Wonder what Legit Security does? Legit Security is an application security posture...

CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL Injection Overview A GraphQL resolver constructs SQL queries dynamically from field aliases. By using batching and aliases, an attacker bypasses an allow‑list and injects SQL. Severity: Critical Database Takeover Node.js Server & Exploit //...

CVE-2026-14894

CVE-2026-14894 — Super Forms ≤ 6.3.313 Overview Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313. The vulnerability resides in the AJAX handler supersubmitform which processes file uploads through a datauristring field without...

call_map

========== Call Map .. default-role:: code About Call Map is a tool for navigating call graphs in Python, with plans to support other languages. Below is a screen shot after running callmap -m toolz, then clicking on some functions. .. figure:: docs/UI-clicked-on-function.png While Call Map is...

CVE-2026-46588

camel-couchdb CouchDb Header Injection Reproducer CVE-2026-46588 This project demonstrates a message-header injection in Apache Camel's camel-couchdb component, tracked as CVE-2026-46588. The component reads several Exchange headers to control its behaviour — CouchDbDatabase, CouchDbSeq, CouchDbI...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

droidbox

Intro DroidBox is developed to offer dynamic analysis of Android applications. The following information is described in the results, generated when analysis is complete: Hashes for the analyzed package Incoming/outgoing network data File read and write operations Started services and loaded...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...

detect-ransomware-filenames

Detect Ransomware Filenames This package/script watches SMB transactions to look for known bad filenames that ransomware is known to use. It rides on top of the Anti-Ransomware File System Resource Manager Lists maintained here. How to use A Python script download-list.py is included to be able t...

OpenFire_Decrypt

OpenFireDecrypt Decrypt the admin console account password of OpenFire install openfire https://hub.docker.com/r/sameersbn/openfire docker pull sameersbn/openfire:3.10.3-19 docker run --name openfire -d --restart=always \ --publish 9090:9090 --publish 5222:5222 --publish 7777:7777 \ --volume...

CVE-2025-2304

Camaleon CMS 2.9.0 – Authenticated Privilege Escalation Role Change + Optional S3 Config Leak Target: Camaleon CMS v2.9.0 Type: Authenticated privilege escalation via mass-assignment in updatedajax role field Extras: Optional extraction of S3 configuration from the admin settings page if the...

longfellow-zk

Longfellow ZK Overview The Longfellow library enables the construction of zero-knowledge protocols concerning legacy identity verification standards such as the ISO MDOC standard, the JWT standard, and W3 Verifiable Credentials. This implementation is described in: Anonymous credentials from ECDS...

pycryptodome

.. image:: https://github.com/Legrandin/pycryptodome/workflows/Integration%20test/badge.svg :target: https://github.com/Legrandin/pycryptodome/actions .. image:: https://badge.fury.io/py/pycryptodome.svg :target: https://pypi.org/project/pycryptodome PyCryptodome PyCryptodome is a self-contained...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - Authenticated Remote Code Execution Exploit ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY - Unauthorized use is illegal and unethical. 📋 Overview This exploit tool demonstrates a critical authenticated remote code execution RCE vulnerability discovered in Krayin CRM version 2.2.x...

PressVector

🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework ⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core 📌 Overview PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two...