83 matches found
EntraFalcon
EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...
DPAT
Domain Password Audit Tool DPAT DPAT is a Python-based security tool that analyzes password hashes extracted from Active Directory domain controllers. It generates comprehensive HTML reports showing password usage statistics, policy violations, and security insights from both NTDS dumps and...
lazyrecon
root@kitploit: / \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e...
attackmapper
AttackMapper Attack Path Visualization & Threat Intelligence Platform Features • Installation • Usage • Threat Intel • Contributing Overview AttackMapper is a CLI tool for red team operations that generates attack paths, maps techniques to the MITRE ATT&CK framework, and integrates real-time thre...
otseca
Open source security auditing tool to search and dump system configuration. Introduction | Description | Requirements | Output | Parameters | Reports | How it works | Other Introduction...
custom-bytecode-analyzer
custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage root@kitploit: usage: java -jar cba-cli.ja...
custom-bytecode-analyzer
custom-bytecode-analyzer Analizador de bytecode de Java personalizable mediante reglas JSON. Es una herramienta de línea de comandos que recibe una ruta que contiene uno o más archivos Jar o War, los analiza utilizando las reglas proporcionadas y genera informes HTML con los resultados. Uso...
lazyrecon
root@kitploit: / \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Uso ./lazyrecon.sh -d domain.com Para excluir subdominios específicos: ./lazyrecon.sh -d domain.com -e...
GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...
MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...
vamp-forticheck
vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...
CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-56389
GNU Bison (a parser generator) is affected by an arbitrary command execution flaw during HTML report generation . A crafted grammar file can override the executable used for the XML-to-HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to...
PYSEC-2026-3029 Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
Summary PySpector versions = 0.1.6 are affected by a stored Cross-Site Scripting XSS vulnerability in the HTML report generator. When PySpector scans a Python file containing JavaScript payloads i.e. inside a string passed to eval , the flagged code snippet is interpolated into the HTML report...
CVE-2026-13083
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting XSS payload into cluster objects such as ClusterVersion...
CVE-2026-13083 Pen-drive: pen-drive: stored xss via unescaped cluster data in html report
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting XSS payload into cluster objects such as ClusterVersion...
CVE-2026-13083
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting XSS payload into cluster objects such as ClusterVersion...
PT-2026-52630
Name of the Vulnerable Software and Affected Versions Pen Drive report generator affected versions not specified Description An issue exists where cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. This allows an attacker with cluster administrator...
PT-2026-51259
Name of the Vulnerable Software and Affected Versions Radware Cyber Controller versions prior to 10.11.0 Description An issue exists within the HTML Report Generation component that allows for HTML injection. This flaw can be exploited remotely to inject malicious HTML code into reports...
