malice

malice Malice's mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company. Try It Out DEMO: demo.malice.io username : malice password : ecilam Requirements Hardware 16GB disk space 4GB RAM Software Docker...

CVE-2026-48356

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-48356 CVE-2026-48356 Magento Open Source 2.4.8-p5 - Adobe I am @abraxasnull. Loopback lab. CVE-2026-48356-Abraxas-Labs.py chdirs into lab/ and runs run.sh. PolyShell. Unauthenticated guest-cart REST accepts...

CVE-2021-21311

CVE-2021-21311 Description SSRFServer-side Request Forgery in Adminer Open Source Database Management tool from v4.0.0 v4.7.8 patched at v4.7.9 Patch commit Usage exploit.py -h -target TARGET -redirect REDIRECT -host HOST -port PORT options: -h, --help show this help message and exit -target TARG...

wraithwall-toolkit

WraithWall Open-Source Toolkit Four deception-engineering tools, lifted out of a production security platform that takes live internet traffic, cleaned of all product/secret coupling, and released under MIT. This isn't a lab demo. Each tool is a piece of WraithWall — a solo-built deception platfo...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 - Adobe I am @abraxasnull. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py. Unauthenticated email-template SSTI. A GraphQL Store header plants...

FlatPress 1.2.1 - Stored Cross-Site Scripting

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-41432 info: name: FlatPress 1.2.1 -...

ThinkPHP < 3.2.4 - Remote Code Execution

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...

LaRecipe < 2.8.1 Remote Code Execution via SSTI

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. id: CVE-2025-53833 info:...

Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion

Oracle GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server. id: CVE-2017-1000029 info: name: Oracle GlassFish Server Open Source Edition 3.0.1 - Local File...

Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

LionWiki <3.2.12 - Local File Inclusion

LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted strings in the index.php f1 variable, aka local file inclusion. id: CVE-2020-27191 info: name: LionWiki 3.2.12 - Local File Inclusion author: 0xAkoko severity: high description: LionWiki before...

Processwire CMS <2.7.1 - Local File Inclusion

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. id: CVE-2020-27467 info: name: Processwire CMS 2.7.1 - Local File Inclusion author: 0xAkoko severity: high description:...

Cacti < 1.2.25 Insecure Deserialization

Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. id: CVE-2023-30534 info: name: Cacti 1.2.25 Insecure Deserialization author: k0pak4 severity: medium description: | Cacti is an open source...

DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been...

Sudomy

Sudomy Subdomain Enumeration & Analysis Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing advanced automated reconnaissance framework. This tool can also be used for OSINT Open-source intelligence activities. Features ! For recent time, Sudomy has these...

GoGhost

GoGhost GoGhost is a High Performance, lightweight, portable Open Source tool for mass SMBGhost Scan. Installation You can download Windows Binary or Linux Binary. Alternatively, GoGhost uses native Golang libraries so the line above would be fine to compile it: go build GoGhost.go Usage Options...

AutoRepeater

AutoRepeater: Automated HTTP Request Repeating With Burp Suite tl;dr Within extender import AutoRepeater.jar Some Brief Instructions AutoRepeater will only resend requests which are changed by a defined replacement. When AutoRepeater receives a request that matches the conditions set for a given...

PsyloDbg

PsyloDbg PsyloDbg is a fast-growing and user-friendly open-source Windows Debugger entirely coded in Delphi. The main goal of this project is to offer to Malware analysts another tool to short their response time during their analysis process. The project is still in very early stage, it is...

Nanobrok

Nanobrok Web Service Web Service write in Python for control and protect your android device remotely. The official app can be found on the PlayStore: NanobrokPro Nanobrok Community Overview Nanobrok-Server is powerful opensource webservice for control and protect your android device, written in...