WebPort-v1.19.1-Reflected-XSS

WebPort-v1.19.1-Reflected-XSS Reflected XSS in WebPort-v1.19.1 impacts users who open a maliciously crafted link or third-party web page. CVE-2019-12460 https://vulners.com/cve/CVE-2019-12460 PoC-1 To exploit vulnerability, someone could use 'http://server:8090/access/setup?type=" request to impa...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. In the 31,132-skill analyzed...

CVE-2022-32114

Strapi v4.1.12 Vulnerability Explanation: An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file Attack Vectors: After uploading a file containing malicious content, when the user opens the link to t...

telfhash

Trend Micro ELF Hash telfhash telfhash is symbol hash for ELF files, just like imphash is imports hash for PE files. With telfhash, you can cluster ELF files by similarity based on symbols. This is particularly useful for clustering malicious samples. If a sample has no symbols, telfhash uses its...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

frida-wshook

frida-wshook frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted...

Security-Datasets

Security Datasets The Security Datasets project is an open-source initiatve that contributes malicious and benign datasets, from different platforms, to the infosec community to expedite data analysis and threat research. Docs https://securitydatasets.com Goals Provide open portable datasets to...

Manalyze

Manalyze Introduction Manalyze is a static analysis tool for PE files that you can use to conduct primary assessment on an executable or set of executables. It collects weak signals that could indicate malicious behavior and displays information that can help a subsequent manual analysis. If you...

CVE-2020-25399

CVE-2020-25399 Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat. Information Description: Attacker can send malicious file to any user using chat functional. File may contain js payload, which executes in...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

CVE-2026-67595

CVE-2026-67595 — Embedded Malicious JavaScript in VaahCMS Security advisory for CVE-2026-67595 : an obfuscated JavaScript spyware payload shipped inside the official releases of VaahCMS a supply-chain / embedded-malicious-code issue, independently discovered and reported by Ilhomjon Rustamov...

cve-2025-48384-poc

PoC for CVE-2025-48384 See CVE-2025-48384 To run: git -c protocol.file.allow=always clone --recurse-submodules [email protected]:liamg/CVE-2025-48384.git Example output: git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test Cloning into 'test'... done. 'ubmodule...

androguard

Androguard Androguard: Reverse engineering and pentesting for Android applications Androguard 5 is a Python toolkit for Android reverse engineering: open an APK, inspect the manifest and DEX, disassemble or decompile code, hunt references and vulnerabilities, and optionally patch or analyze nativ...

tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say sudo dnf install tcpflo...

CVE-2024-45427-Exploit

CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...

scan-cve-2018-8115

/\ / | | / \ | | | / /\ \ / | | | |/ | \ \ / / | | | | '| | | | | | / \ | | || | | | | / | || | | | | || || | // \, |,|,| |/ ||,|| |||, | | | / | || |/ Docker images verifier cli-tool CVE-2018-8115 To help the community stay safe, we at Aqua created an open source tool that tests images...

Ios-Safari-Mallicous-Extension-Example

Ios-Safari-Mallicous-Extension-Example Example on how to injectioncurrently under work of keylogger js through Safari Extensionthat part done...

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

Crawlector

Crawl e ctor Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat-hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube...