CVE-2026-93509 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-93509 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...

CVE-2026-105190 Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives...

CVE-2026-105190 Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives...

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza,...

CVE-2026-107503

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...

burp-ai-agent

Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...

Awesome-Hacking-Resources

Awesome Hacking Resources A curated collection of hacking, penetration testing, and AI red-teaming resources to make you better. Let's make it the biggest resource repository for our community. You are welcome to fork and contribute. We also maintain a companion tools list — contributions welcome...

pyGPOAbuse

pyGPOAbuse Filter Additions by D4RKMATT3R DISCLAIMER: This was only tested briefly in a local AD environment I take no responsibility for any unprecedented behavior or malfunctioning, it is provided as-is, for authorized testing only, entirely at your own risk. Now supports filtered targeting of...

CVE-2023-22894

Unauthenticated Strapi Exploit: CVE-2023-22894 This repository contains a proof of concept PoC exploit for CVE-2023-22894, which allows unauthenticated users to leak sensitive information and hijack Strapi administrator accounts by exploiting Strapi's filtering functionality on private fields...

DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

gitxray

Welcome to Gitxray Gitxray short for Git X-Ray is a multifaceted security tool designed for use on GitHub repositories. It can serve many purposes, including OSINT and Forensics. gitxray leverages public GitHub REST APIs to gather information that would otherwise be very time-consuming to obtain...

coalmine

Cloud Canary Token Management — Deploy, monitor, and rotate deceptive credentials across AWS and GCP to detect unauthorized access. !WARNING Alpha Version — Coalmine is in early development. Basic functionality is the current priority, and the application should not be considered fully security...

FarsightAD

FarsightAD Table of Contents FarsightAD Table of Contents Description Prerequisite Basic usage AD Hunting cmdlets Demo Fully / partially hidden objects detection Acknowledgements Thanks Author Licence Description FarsightAD is a PowerShell script that aim to help uncovering eventual persistence...

bug-reaper

BugReaper Structured web2 bug bounty AI skill — 18 vulnerability classes, 4 bug bounty platforms, zero AI slop. Compatible with OpenClaw, Cursor, Claude Code, Antigravity, and Windsurf. BugReaper is an Agent Skill that turns any compatible AI agent into a disciplined web2 bug bounty hunter. It...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

IG-Detective

IG-Detective 🕵️‍♂️📸 Created by@shredzwho | 💖 Sponsor this project IG-Detective is a high-performance, Python-based Open Source Intelligence OSINT tool for Instagram. It offers a premium interactive shell to perform deep analysis on Instagram accounts, extract location history, mapping interactions,...

CrucibleC2

HardHat C2 A cross-platform, collaborative, Command & Control framework written in C, designed for red teaming and ease of use HardHat is a multi-user C .NET-based command and control C2 framework designed to aid in red team engagements and penetration testing. It aims to improve quality-of-life...

bramble

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

goblob

Goblob 🫐 Goblob is a lightweight and fast enumeration tool designed to aid in the discovery of sensitive information exposed publicy in Azure blobs, which can be useful for various research purposes such as vulnerability assessments, penetration testing, and reconnaissance. Warning. Goblob will...