API-Security

OWASP API Security Top 10 This project is designed to address the ever-increasing number of organizations that are deploying potentially sensitive APIs as part of their software offerings. These APIs are used for internal tasks and to interface with third parties. Unfortunately, many APIs do not...

MLflow-Vuln

Vuln replication-mlflow ver 2.1.1-prep by Saima.pdf MLflow-Vulnerability MLflow LFI/RFI Vulnerability -CVE-2023-1177 - Reproduced One of the most popular tools in a ML system is MLflow that is used for managing end-to-end machine learning lifecycle. I tested the security of MLflow and reproduced ...

CVE-2022-22947

CVE-2022-22947 script for exploit Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 https://github.com/march0s1as/CVE-2022-22947 cd CVE-2022-22947 go build spring.go ./spring -h...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

VAmPI

VAmPI The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes...

cybermeowfia-termux

CyberMeowfia Termux Root Manager Termux privilege escalation tool and Root permission manager based on CVE-2026-43501 kernel vulnerability. Features CVE-2026-43501 kernel vulnerability exploitation Flask web management interface 25 APIs HMAC-SHA256 token authentication Process management, file...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

libpcap

LIBPCAP 1.x.y by The Tcpdump Group To report a security issue please send an e-mail to [email protected]. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the guidelines for contributing. The documentation directory has README...

CVE-2024-48061

CVE-2024-48061 Langflow vulnerable to remote code execution CVE-2024-48061 poc Usage python3 poc.py -i -p -l -lp Description This script exploits a vulnerable API endpoint at /api/v1/validate/code on the target web server. It first verifies the presence of the vulnerable path, then starts a TCP...

crAPI

crAPI c ompletely r idiculous API crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. crAPI is modern, built on top of a microservices architecture. When time has come to buy your...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure Description The is vulnerable to sensitive information disclosure due to improper access control in the /core/forms/action.php file which can be exploited by an...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2020-25540

cve-2020-25540 This script is used to exploit arbitrary file read vulnerabilities in ThinkAdmin v5 and v6 versions ==Note that the interface path may vary across different versions some are based on the original ThinkAdmin with secondary development== The original interface is:...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress pip install macaddress ./bin2mac.py calc.bin...

CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — Unauthenticated Member PII Disclosure via REST API 📖 Advisory Overview CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information PII disclosure vulnerability affecting the NewPath WildApricotPress...

socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...