radare2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.5, next release will be 6.2.6. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

goblin

libgoblin Documentation https://docs.rs/goblin/ changelog Usage Goblin requires rustc 1.85.0 Rust 2024 edition. Add to your Cargo.toml dependencies goblin = "0.10" Features awesome crate name zero-copy, cross-platform, endian-aware, ELF64/32 implementation - wow! zero-copy, cross-platform,...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

bypass-403

Bypass-403 A simple script just made for self use for bypassing 403 It can also be used to compare responses on verious conditions as shown in the below snap Usage ./bypass-403.sh https://example.com admin ./bypass-403.sh website-here path-here Features Use 24 known Bypasses for 403 with the help...

assetfinder

assetfinder Find domains and subdomains potentially related to a given domain. Install If you have Go installed and configured i.e. with $GOPATH/bin in your $PATH: go get -u github.com/tomnomnom/assetfinder Otherwise download a release for your platform. To make it easier to execute you can put t...

EUVD-2026-114065

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

slsa

SLSA "salsa" is Supply-chain Levels for Software Artifacts SLSA pronounced "salsa" is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to bein...

CVE-2017-12617

CVE-2017-12617 Code put together from a few peoples ideas credit given don't use maliciously please...

apkleaks

APKLeaks Scanning APK file for URIs, endpoints & secrets. Installation from Pypi from Source from Docker Usage Options Output Pattern Arguments for disassembler License Acknowledments Installation It's fairly simple to install APKLeaks : from PyPi $ pip3 install apkleaks from Source Clone...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

aftermath

About Aftermath is a Swift-based, open-source incident response framework. Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM ideally, but it can also run independently from the infected...

avpass

AVPASS AVPASS is a tool for leaking the detection model of Android malware detection systems i.e., antivirus software, and bypassing their detection logics by using the leaked information coupled with APK obfuscation techniques. AVPASS is not limited to detection features used by detection system...

nimcrypt

nimcrypt Nimcrypt is a .NET PE Crypter written in Nim, based entirely on the work of @byt3bl33d3r's OffensiveNim project: https://github.com/byt3bl33d3r/OffensiveNim This tool was inspired by @S3cur3Th1sSh1t's blog post a few months ago, as it's essentially just a full PoC of what he presented:...

pown

Pown Pown.js is a security testing and exploitation toolkit built on top of Node.js and NPM. Unlike traditional security tools, notably Metasploits, Pown.js considers frameworks to be an anti-pattern. Therefore, each feature in Pown is in fact a standalone NPM module allowing greater degree of...

pathprober

pathprober Probe and discover HTTP pathname using brute-force methodology and filtered by specific word or 2 words at once. Purpose Brute-forcing website directories or HTTP pathname and validate using HTTP response code is not relevant anymore. This tool will help you to perform a penetration...

CVE-2026-113670 ApostropheCMS: Page REST API authorization bypass

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...

TheWebShop Bootstrap Shortcodes Development Workflow Cross-site Script Vulnerabilities

TheWebShop Bootstrap Shortcodes Development Workflow: Versions prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability occurred when the ID attribute of the bstcontent shortcode was output into HTML attributes without proper quotation marks, and spaces were not encoded...

PT-2026-107268

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.21.10 Description The @backstage/plugin-kubernetes-backend package contains an unsupported catalog cluster authentication mode. In deployments utilizing catalog cluster discovery, the issue arises when catalog...

EUVD-2026-85805

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review t...