archerysec

Support. Your generous donations will keep us motivated. Paypal: Archery Overview of the tool Note Requirements OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners Installation Windows Installation Note on installation for developers and contributors Note on manual and automated installatio...

hoverfly

API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypass Vulnerability ⚠️ Disclaimer This tool is only for cybersecurity offensive and defensive research and exchange. Please use it in compliance with the Cybersecurity Law！ If the user engages in illegal attacks or other illegal...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 Unified PoC for CVE-2025-54236 "SessionReaper", a critical unauthenticated RCE in Magento 2 / Adobe Commerce via nested deserialization in the REST API. CVSS: 9.1 Critical Root cause: Improper Input Validation CWE-20 in ServiceInputProcessor; the exploit primitive i...

Argos

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture +-----------------------+ | Frontend React 19 | | Vite +...

vt-py

vt-py This is the official Python client library for VirusTotal. With this library you can interact with the VirusTotal REST API v3 and automate your workflow quickly and efficiently. Things you can do with vt-py Scan files and URLs Get information about files, URLs, domains, etc Perform VirusTot...

CVE-2021-42559

CVE-2021-42559: Command Injection via Configurations in MITRE Caldera Caldera versions =2.8.1 contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the Rest API, an authenticated user can insert arbitrary commands that...

Zena-CVE-2021-45026

Zena - Stored XSS to RCE Exploit POC Exploit POC for Rocket Software's Zena application v. 4.2.1 - Stored XSS to RCE CVE-2021-45025 CVE-2021-45026 https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html POC Process: Logs into Zena's webconfig page using default credentials Drops Stored XSS...

PyJFuzz

LOGO PyJFuzz is a small, extensible and ready-to-use framework used to fuzz JSON inputs , such as mobile endpoint REST API, JSON implementation, Browsers, cli executable and much more. Version | 1.1.0 ---|--- Homepage | http://www.mseclab.com/ Github | https://github.com/mseclab/PyJFuzz Author |...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

whatportis

whatportis .. image:: https://github.com/opencve/opencve/workflows/Tests/badge.svg :target: https://github.com/ncrocfer/whatportis/actions/workflows/tests.yml .. image:: https://badge.fury.io/py/whatportis.svg :target: https://pypi.python.org/pypi/whatportis/ .. image::...

CVE-2024-3605

CVE-2024-3605 WP Hotel Booking = 2.1.0 - Unauthenticated SQL Injection Description The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'roomtype' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to...

BARK

BARK BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services. BARK requires no third party...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Plugin Acyber Wordpress !WARNING Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 wp2shell کاهش مخاطره اضطراری و موقت برای زنجیره آسیب‌پذیری wp2shell 🇬🇧 English Description This lightweight WordPress plugin serves as a temporary virtual patch mitigation against the critical...