CVE-2026-39987 Proof of Concept. Contribute to stapat1245/CVE-2026-39987-PoC development by creating an account on GitHub.

A behavioral network analysis tool that detects Command and Control (C2) beaconing, DNS anomalies, and known malicious infrastructure in live or captured traffic. - HunterBFranklin/pcap-analyzer

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox cre...

Reverse engineering the Burp project format to create a extractor tool. - parsiya/prub

Shellcode Injection using WinAPI. Educational research on memory manipulation and EDR evasion techniques. - Michel-DV/Windows-Process-Injector-C

Demo: company-standard logging/tracing util lib. Part of a 3-repo chain used to test transitive-dependency vulnerability handling in vuln-remediation-agent. Deliberately depends on a vulnerable log...

Full build-and-attack writeup for a self-hosted AD lab: domain controller setup, realistic domain population, then a full attack chain against it, SMB/LDAP enumeration, Kerberoasting and ASREPRoast...

Cypher injection in Graphiti via unsanitized node_labels — CVE-2026-32247 / CVSS 8.1 - romain-deperne/CVE-2026-32247

Reverse engineering and runtime analysis of the PackClient modular RAT framework: Launcher and Core internals, protocol reconstruction, tooling, and detection engineering. - ivanimmanuel-dev/PackCl...

Arbitrary file read in mcp-atlassian via confluence_upload_attachment — CVE-2026-77262 / GHSA-p6hp-93wp-fh6p - romain-deperne/CVE-2026-77262

GhostJS — ZAP add-on that passively scans JavaScript responses for hard-coded secrets and discovers API endpoints, source maps, and cloud-storage URLs (port of Ghost-Js-Burp-Extension). - ArkhaMahn...

Android Security Assessment and SAST Vulnerability Scanner based on OWASP MASVS & Mobile Top 5 - sravanibandreddy/android-application-penetration-testing

Contribute to bright77777/cpanel-whm-authbypass-to-rce development by creating an account on GitHub.

PortSwigger Web Security Academy — Advanced Track. Hands-on exploitation of SSRF, Insecure Deserialization, and SSTI, with full PDF report and PoC screenshots. - itsmariamfatima/week-4-websec-w01-a...

Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php — CVSS 7.5 - romain-deperne/CVE-2026-33715

OS command injection in KubeAI via an Ollama model URL — CVE-2026-34940 / CVSS 8.7 - romain-deperne/CVE-2026-34940

CRLF email header injection in Plunk raw MIME construction — CVE-2026-34975 / CVSS 8.5 - romain-deperne/CVE-2026-34975

Bifrost Finance — stored XSS via backend database leading to one-click wallet drain. Submitted via Immunefi. - ChristopherPatrickKuntz/bifrost-xss-disclosure

Demo: leaf app depending on transdep-demo-service-lib (2 hops from a vulnerable log4j-core dep in transdep-demo-util-common). Test target for the transitive-dependency gap in vuln-remediation-agent...

Aurelius M5 demo — Maven project with a deliberately outdated log4j-core for the log4shell-bump patch runner to fix - aureliusgovenai/m5-log4shell-demo