MADE WITH
PAYLOAD CMS

A hand-curated, daily-updated gallery of open-source projects. Browse the ecosystem, ranked by GitHub stars.

★ Most stars ▾

423 projects

Tools and Techniques for Red Team / Penetration Testing. Maintained by A-poc on GitHub, where it has earned 9,441 stars from the community.

All about bug bounty (bypasses, payloads, and etc). Maintained by daffainfo on GitHub, where it has earned 6,804 stars from the community.

@daffainfo3y ago

Awesome XSS stuff. Maintained by s0md3v on GitHub, where it has earned 5,131 stars from the community.

An AI Gateway, registry, and proxy that sits in front of any MCP, A2A, or REST/gRPC APIs, exposing a unified endpoint with centralized discovery, guardrails and management. Optimizes Agent & Tool calling, and supports plugins. Maintained by IBM on GitHub, where it has earned 4,578 stars from the community.

Generate Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV. Maintained by datamodel-code-generator on GitHub, where it has earned 4,028 stars from the community.

@datamodel-code-generator1h ago

Git All the Payloads! A collection of web attack payloads. Maintained by foospidy on GitHub, where it has earned 3,966 stars from the community.

@foospidy3y ago

Python Remote Administration Tool (RAT). Maintained by nathanlopez on GitHub, where it has earned 3,626 stars from the community.

@nathanlopez2y ago

Codex/ChatGPT multiple account load balancer & proxy with usage tracking, dashboard, and OpenCode-compatible endpoints. Maintained by Soju06 on GitHub, where it has earned 3,306 stars from the community.

CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems. Maintained by tiagorlampert on GitHub, where it has earned 2,815 stars from the community.

@tiagorlampert1y ago

Penetration tests guide based on OWASP including test cases, resources and examples. Maintained by Voorivex on GitHub, where it has earned 2,815 stars from the community.

@Voorivex4y ago

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting. Maintained by ssl on GitHub, where it has earned 2,322 stars from the community.

C++ GUI for TegraRcmSmash (Fusée Gelée exploit for Nintendo Switch). Maintained by eliboa on GitHub, where it has earned 2,273 stars from the community.

Medusa，XSS、、CVE、、DNSLOG、、，. Maintained by Ascotbe on GitHub, where it has earned 2,235 stars from the community.

Java ｜A customizable Java in-memory webshell generation tool. Maintained by pen4uin on GitHub, where it has earned 2,219 stars from the community.

Java Vulnerability Exploitation Platform. Maintained by vulhub on GitHub, where it has earned 2,121 stars from the community.

RubberDucky like payloads for DigiSpark Attiny85. Maintained by MTK911 on GitHub, where it has earned 1,625 stars from the community.

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions. Maintained by tokyoneon on GitHub, where it has earned 1,586 stars from the community.

@tokyoneon4y ago

Java Web ，，. Maintained by ReaJason on GitHub, where it has earned 1,549 stars from the community.

@ReaJason3mo ago

Burp Suite Certified Practitioner Exam Study. Maintained by botesjuan on GitHub, where it has earned 1,440 stars from the community.

@botesjuan7mo ago

Learn how to build an incredible e-commerce webshop with an admin dashboard and CMS using Next 14, Stripe, TypeScript, and Payload CMS. Maintained by adrianhajdin on GitHub, where it has earned 1,437 stars from the community.

@adrianhajdin1y ago

Reflective PE packer. Maintained by EgeBalci on GitHub, where it has earned 1,428 stars from the community.

@EgeBalci2y ago

MSFvenom Payload Creator (MSFPC). Maintained by g0tmi1k on GitHub, where it has earned 1,329 stars from the community.

Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. Maintained by infobyte on GitHub, where it has earned 1,329 stars from the community.

@infobyte5y ago

Payload for teensy like a rubber ducky but the syntax is different. this Human interfaes device ( HID attacks ). Penetration With Teensy. Brutal is a toolkit to quickly create various payload,powershell attack, virus attack and launch listener for a Human Interface Device ( Payload Teensy ). Maintained by screetsec on GitHub, where it has earned 1,264 stars from the community.

@screetsec6y ago

Athena OS is a Arch/Nix-based distro focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!. Maintained by Athena-OS on GitHub, where it has earned 1,247 stars from the community.

@Athena-OS3mo ago

CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks. Maintained by Puliczek on GitHub, where it has earned 950 stars from the community.

@Puliczek4y ago

AppSec Payloads Arsenal for Pentration Tester and Bug Bounty Hunters. Maintained by sh377c0d3 on GitHub, where it has earned 940 stars from the community.

@sh377c0d36mo ago

Infosec Wordlists and more. Maintained by xajkep on GitHub, where it has earned 938 stars from the community.

Apkmod can decompile, recompile, sign APK, and bind the payload with any legit APP. Maintained by Hax4us on GitHub, where it has earned 818 stars from the community.

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things. Maintained by GhostTroops on GitHub, where it has earned 732 stars from the community.

@GhostTroops3mo ago

ALL IN ONE Hacking Tool For Hackers, Penetration Tester and Cybersecurity. New Version Beginner to Advanced Tool. This Tool is made for educational purpose only! Author will not be responsible for any misuse of this toolkit!. Maintained by CodingRanjith on GitHub, where it has earned 728 stars from the community.

@CodingRanjith1y ago

The official Next.js website for payloadcms.com. Maintained by payloadcms on GitHub, where it has earned 632 stars from the community.

@payloadcms3w ago

Its a framework filled with alot of options and hacking tools you use directly in the script from brute forcing to payload making im still adding more stuff i now have another tool out called htkl-lite its hackers-tool-kit just not as big and messy to see updates check on my instagram @tuf_unkn0wn or if there are any problems message me on instagram. Maintained by unkn0wnh4ckr on GitHub, where it has earned 582 stars from the community.

@unkn0wnh4ckr5y ago

link is a command and control framework written in rust. Maintained by postrequest on GitHub, where it has earned 579 stars from the community.

@postrequest5y ago

RomBuster is a router exploitation tool that allows to disclosure network router admin password. Maintained by EntySec on GitHub, where it has earned 556 stars from the community.

Agili AIGC - Agentic AI Agent AIGC（）。. Maintained by miantiao-me on GitHub, where it has earned 550 stars from the community.

@miantiao-me3mo ago

AI Plugin is a powerful extension for the Payload CMS, integrating advanced AI capabilities to enhance content creation and management. Maintained by ashbuilds on GitHub, where it has earned 537 stars from the community.

@ashbuilds2mo ago

DJI Payload SDK Official Repository. Maintained by dji-sdk on GitHub, where it has earned 519 stars from the community.

@dji-sdk6mo ago

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js. Maintained by HynekPetrak on GitHub, where it has earned 476 stars from the community.

@HynekPetrak3y ago

transform your payload.exe into one fake word doc (.ppt). Maintained by r00t-3xp10it on GitHub, where it has earned 468 stars from the community.

@r00t-3xp10it6y ago

Simple and easy Metasploit payload generator for Linux & Termux. Maintained by Deadpool2000 on GitHub, where it has earned 464 stars from the community.

@Deadpool20002y ago

Java ｜A customizable Java echo payload generation tool. Maintained by pen4uin on GitHub, where it has earned 464 stars from the community.

Generates malicious LNK file payloads for data exfiltration. Maintained by Plazmaz on GitHub, where it has earned 457 stars from the community.

PE loader with various shellcode injection techniques. Maintained by Hagrid29 on GitHub, where it has earned 454 stars from the community.

@Hagrid293y ago

Payload | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript. Maintained by 3516634930 on GitHub, where it has earned 442 stars from the community.

@35166349303mo ago

A fast & natively cross-platform Android OTA payload extractor written in Go. Maintained by tobyxdd on GitHub, where it has earned 437 stars from the community.

AiScan-N ！Ai（），、、、、，Ai【CLI Agent】，Ai，（），，（），！：（、CTF、Web、、、、APT、）（）：https://mp.weixin.qq.com/s/7lsUdbrxkDy4P5pZhEWv7Q. Maintained by SecNN on GitHub, where it has earned 397 stars from the community.

This repository contains full code examples from the book Gray Hat C#. Maintained by brandonprry on GitHub, where it has earned 397 stars from the community.

@brandonprry4y ago

Hide your payload into.jpg file. Maintained by Tsuyoken on GitHub, where it has earned 395 stars from the community.

@Tsuyoken4y ago

This repository contains payload to test NoSQL Injections. Maintained by cr0hn on GitHub, where it has earned 380 stars from the community.

A collection of selected badUSB script for Flipper Zero, written by me. This repo is always Work In Progress. Maintained by grugnoymeme on GitHub, where it has earned 374 stars from the community.

@grugnoymeme1y ago

Repository for Flipper Zero/USB Rubber Ducky payloads. Maintained by Mr-Proxy-source on GitHub, where it has earned 351 stars from the community.

@Mr-Proxy-source7mo ago

[P1-$10,000] Google Chrome, Microsoft Edge and Opera - vulnerability reported by Maciej Pulikowski - System environment variables leak - CVE-2022-0337. Maintained by Puliczek on GitHub, where it has earned 340 stars from the community.

@Puliczek4y ago

Payload 3.0 enchantment packages. Maintained by r1tsuu on GitHub, where it has earned 336 stars from the community.

Modular penetration testing platform that enables you to write, test, and execute exploit code. Maintained by EntySec on GitHub, where it has earned 328 stars from the community.

@EntySec6mo ago

Authentication plugin for Payload CMS. Maintained by UPDOT on GitHub, where it has earned 308 stars from the community.

Payload CMS plugin which provides a visual live editor directly in the Admin UI. Works for collections and globals. Compatible with any kind of JS/TS based frontend technology. Maintained by pemedia on GitHub, where it has earned 306 stars from the community.

Bad char generator to instruct encoders such as shikata-ga-nai to transform those to other chars. Maintained by cytopia on GitHub, where it has earned 294 stars from the community.

This plugin aims to provide you with very specific and improved fields for the Payload admin panel. Maintained by NouanceLabs on GitHub, where it has earned 290 stars from the community.

@NouanceLabs1y ago

Open repository for learning dynamic shellcode loading (sample in many programming languages). Maintained by ReversingID on GitHub, where it has earned 288 stars from the community.

@ReversingID4mo ago

What is Payload CMS?

Payload is a TypeScript headless CMS and app framework built for Next.js developers. This gallery lists 423 open-source projects built with Payload CMS, most of them in DevTools, E-commerce and AI & ML, ranked by GitHub stars so the most-adopted repositories come first.

How projects are selected

Projects are public GitHub repositories found with the GitHub search query “topic:payloadcms” and at least 10 stars. Each repository is checked against Payload CMS’s languages and ecosystem before it is categorized, and stars, forks and last-commit dates come straight from the GitHub API, refreshed daily (current snapshot: October 6, 2026). Nothing here is paid placement.

Payload CMS projects: FAQ

How many open-source Payload CMS projects are listed?: 423 open-source projects built with Payload CMS are listed, sourced from public GitHub repositories as of October 6, 2026.
What is the most-starred Payload CMS project on GitHub?: RedTeam-Tools by A-poc leads with 9,441 GitHub stars (9.4k), followed by AllAboutBugBounty with 6,804.
What kinds of projects are built with Payload CMS?: The largest category is DevTools, with 288 projects (68% of the gallery), followed by E-commerce with 18. Projects span 14 categories in total.
Which license do most Payload CMS projects use?: MIT is the most common license, used by 193 of 423 projects (46%); GPL-3.0 is next with 36. 153 projects declare no recognized license.

From the blog

Latest Payload CMS guides & deep-dives

All articles →

Payload CMSGuidePayload CMS (payload): GitHub Repository Spotlight

Deep repository profile of Payload CMS (payload) covering purpose, maintenance signals, health, intended users, evidence-backed strengths and limitations, and a safe adoption checklist.

MMadeWithWhat Editorial Team · Jul 11, 2026 · 13 min

Video archive

Payload CMS talks, tutorials & deep-dives

I Built a Client Website + Custom CMS Dashboard in Claude Code

I Built a Client Website + Custom CMS Dashboard in Claude Code

LLukas Margerie · 17K views · Apr 26, 2026

How does a Headless CMS work (explained simply)

How does a Headless CMS work (explained simply)

AAdrian Twarog · 26K views · Nov 7, 2025

Payload CMS: Fast Admin UI Custom Views

Payload CMS: Fast Admin UI Custom Views

AAaron Saunders · 13K views · Jan 6, 2025