fuzzable

Fuzzable Framework for Automating Fuzzable Target Discovery with Static Analysis Introduction Vulnerability researchers conducting security assessments on software will often harness the capabilities of coverage-guided fuzzing through powerful tools like AFL++ and libFuzzer. This is important as ...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

Apache Unomi - Remote Code Execution

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code. id: CVE-2020-11975 info: name: Apache Unomi -...

Solara <1.35.1 - Local File Inclusion

A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. ...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

ghidra2frida

ghidra2frida ghidra2frida is a Ghidra Extension that, working as a bridge between Ghidra and Frida, lets you create powerful Ghidra scripts that take advantage of Frida's dynamic analysis engine to improve Ghidra statical analysis features. It supports all platforms supported by Frida Windows,...

zizmor

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds:...

deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

remill

Remill Remill is a static binary translator that translates machine code instructions into LLVM bitcode. It translates AArch64 64-bit ARMv8, SPARC32 SPARCv8, SPARC64 SPARCv9, x86 and amd64 machine code including AVX and AVX512 into LLVM bitcode. AArch32 32-bit ARMv8 / ARMv7 support is underway...

IDA2Obj

IDA2Obj IDA2Obj is a tool to implement SBI Static Binary Instrumentation. The working flow is simple: Dump object files COFF directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at an...

PulseAPK-Core

PulseAPK 🌍 Languages English | Deutsch | Español | Français | עברית | 한국어 | Беларуская | Suomi | Latviešu | Eesti | Lietuvių | Čeština | Slovenčina | Magyar | العربية | Português | Русский | Українська | 中文 PulseAPK is a professional-grade, cross-platform GUI for Android reverse engineering and...

gitcolombo

Gitcolombo OSINT 工具，可从 git 仓库和 GitHub 中提取身份信息——姓名、电子邮件以及看似无关账户之间的联系。 Python CLI （gitcolombo.py）——克隆仓库、遍历 git log，并可调用 GitHub API 以获取更丰富的信号。 Web 版本 （gitcolombo.html）——单个静态 HTML 文件；在浏览器中打开，直接查询 GitHub API，无需安装。 关于每封邮件/每个姓名的来源（PGP 密钥、公开事件、提交搜索、提交消息尾部等）的完整说明，请参阅 docs.md 。 Web 版本 托管于...

Apkx-Hunter

APKX-Hunter v2.7.2 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...

rev-dep

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • CLI Reference Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale,...

rev-dep

Rev-dep 功能 • 安装 • 文档 • 探索工具包 • CLI 参考 面向现代 JavaScript 和 TypeScript 代码库的依赖分析与优化工具包。 通过非常快速的 CLI 强制依赖图卫生并移除未使用代码。 关于 📣 随着代码库规模扩大，在头脑中维护依赖关系图变得不可能。Rev-dep 是一款高速静态分析工具，旨在为大型 JS/TS 项目强制实施架构完整性和依赖卫生。 可以把 Rev-dep 视为依赖关系图的高速 lint 工具。 将来自多个慢速工具的碎片化、顺序检查整合到一个高性能引擎中。 Rev-dep...