Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
Repository Index
75,859 visible repositories in the index
169–191 of 191 · Most stars
TranslatedCyclops is a browser with XSS detection capabilities
- security
- xss
- taint-tracking
- vulnerability
御枢 · AegisOps — AI 安全运营工作台：告警研判、应急响应、漏洞整改，连接 Atlas、模型、工具与工作流。
- ai-agents
- secops
- security-operations
- vulnerability-management
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
- crtsh
- cve
- cve-2026-109618
- cve-2026-109619
Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.
- cybersecurity
- hacking
- iast
- dast
A honeypot for the Log4Shell vulnerability (CVE-2021-44228).
Vulnerable Web applications Generator
- vulnerabilities
- docker
- python
- generator
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
Security training for the apps you actually ship. Open your browser and start hacking.
A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.
Example repository for GitHub Actions Time of Check to Time of Use (TOCTOU vulnerabilities)
- actions
- bugbounty
- cicd
A vulnerability patch gathering tool
XSSMaze is a web service designed to test and improve the performance of security testing tools by providing various cases of XSS vulnerabilities.
WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. This is a Remote Code Execution vulnerability.
- security
- security-tools
- honeypot
- deception
National Vulnerability Database (NVD) implemented by rust
- cpe
- cve
- cvss
- nvd
Express honeypot for RFI and LFI bots: 310 fake vulnerable URLs, logs IP, geolocation and payloads. Docker bait server or app.use() middleware.
MICROS Honeypot is a low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS). This is a directory traversal vulnerability.
- honeypot
- micros
- vulnerability
- security
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code
A plugin based GraphQL vulnerability assessment tool.
- graphql
- graphql-security
- pentest-tool
- python3
Crystal shard wrapping the rbsec/sslscan utility
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.
- cdn
- cve
- polyfill
- polyfill-io
Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.
Detect CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Fast, accurate scanner with zero false positives.