ASST

ASST BETA OWASP ASST Automated Software Security Toolkit | A Novel Open Source Web Security Scanner. Note: AWSS is the older name of ASST Introduction Web applications have become an integral part of everyday life, but many of these applications are deployed with critical vulnerabilities that can...

semgrep

Code scanning at ludicrous speed...

trivy-action

Trivy Action Trivy 的 GitHub Action !GitHub Releaserelease-imgrelease !GitHub Marketplacemarketplace-imgmarketplace !Licenselicense-imglicense 目录 用法 扫描 CI 流水线 扫描 CI 流水线（使用 Trivy 配置） 缓存 Trivy 设置 扫描 Tarball 文件 使用 Trivy 与模板 使用 Trivy 与 GitHub 代码扫描 使用 Trivy 扫描 Git 仓库 使用 Trivy 扫描根文件系统目录 使用 Trivy 扫描基础设施即...

bearer

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

jfrog-CVE-2022-21449

CVE-2022-21449 Overview This tool allows to perform a quick scan of compiled code archives .jar, .war etc in order to check for vulnerability to CVE-2022-21449 by looking for the string indicating the use of ECDSA algorithm. The tool uses Python3 with no additional prerequisites. Usage...

jsecret

jsecret simple and fast tool to detect sensitive data in the source code such as javascript files or others install go install -v github.com/raoufmaklouf/jsecret@latest Usage cat jsfiles.txt | jsceret echo http://test.tld/main.js | jsecret Big thank to https://twitter.com/medmahmoudi619 for helpf...

semgrep-rules

semgrep-rules ¡Bienvenido! Este repositorio contiene las reglas de la Community Edition de Semgrep. Además de las reglas de este repositorio, el Semgrep Registry ofrece Pro rules propietarias que amplían la cobertura de lenguajes y desbloquean el análisis de dataflow entre archivos y profundo...

codex-security

Codex Security @openai/codex-security es una CLI y un SDK de TypeScript para encontrar, validar y corregir vulnerabilidades de seguridad en tu código. 👉👉 Consulta ladocumentación de Codex Security para ver la documentación completa. Algunas solicitudes de ciberseguridad y hallazgos protegidos...

URLextractor

URLextractor Information gathering & website reconnaissance Usage: ./extractor http://www.hackthissite.org/ Tips: Colorex: put colors to the ouput pip install colorex and use it like ./extractor http://www.hackthissite.org/ | colorex -g "INFO" -r "ALERT" Tldextract: is used by dnsenumeration...

joern

Joern 查询数据库（"Joern-Scan"） 这是开源代码分析平台 Joern 的核心查询数据库。它有两个用途： 它提供了将 Joern 转变为即用型代码扫描工具所需的“电池”。 它的查询可作为那些希望编写自己查询的人的示例。 基于 JDK11 构建，但运行在 JRE = 1.8 上 查询数据库作为一个独立的库分发，其中包括 Joern 作为依赖项。这意味着无需安装 Joern 即可使用数据库中的查询。 同时，数据库是一个 Joern 扩展，即在启动时动态加载后，其功能可在交互式 Joern shell 和 Joern 脚本中使用。 你可以 fork...

CVE-2021-43530-UXSS-On-QRcode-Reader-

CVE-2021-43530-UXSS-On-QRcode-Reader- CVE-2021-43530 A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. This bug only affects Firefox for Android. Other operating systems are unaffected.. This...

sonarcloud-scan

Bitbucket Pipelines Pipe: SonarQube Cloud scan Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages. Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for...

static-code-analysis-helper

Static-Code-Analysis-Helper Descripción Detecta funciones que probablemente causen metodologías de ataque en muchos lenguajes de programación web y frameworks de tu carpeta de proyecto. Te ayuda a realizar análisis de código estático. Nota : Muchas de las funciones descritas aquí pueden no causar...

raptor

Raptor 是一个基于网页（Web服务+UI）的、以 GitHub 为中心的源码漏洞扫描器——它只需提供 GitHub 仓库 URL 即可扫描仓库。你可以设置 Webhook，以确保每次提交或合并 Pull Request 时自动扫描。扫描是异步进行的，结果仅对启动扫描的用户可见。 Raptor 的部分特性： 插件架构（即插即用外部工具，生成统一报告） Web 服务可用于自定义自动化（无需 UI） 轻松创建/编辑/删除新漏洞和/或编程语言的签名...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code...

CVE-2026-41471

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

CVE-2026-41471

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

CVE-2026-41471

The CVE concerns the Easy PayPal Events & Tickets WordPress plugin (version 1.3 and earlier). A vulnerability in the QR code scanning endpoint (scan_qr.php) allows unauthenticated attackers to enumerate and retrieve all customer order records by iterating sequential WordPress post IDs, exposing s...

CVE-2026-32834

Summary: CVE-2026-32834 affects the WordPress plugin Easy PayPal Events & Tickets (version 1.3 and earlier). The vulnerability is a hardcoded authentication bypass in the QR code scanning functionality, allowing unauthenticated remote attackers to bypass hash verification by sending the hash para...

WordPress plugin Easy PayPal Events & Tickets 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...