CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - Broken Authentication CVE-2025-68860 Description The WordPress Mobile Builder plugin version 1.4.2 and below has a Broken Authentication vulnerability that allows an attacker to generate a valid JWT token with the default secret "examplekey" and authenticate as...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

git-all-secrets

git-all-secrets Acerca de git-all-secrets es una herramienta que puede: Clonar múltiples repositorios públicos/privados de GitHub de una organización y escanearlos, Clonar múltiples repositorios públicos/privados de GitHub de un usuario que pertenece a una organización y escanearlos, Clonar un so...

shhgit

🚨 shhgit ya no se mantiene. Si necesitas soporte o consultoría para tus esfuerzos de escaneo de secretos, envíame un correo electrónico a [email protected] 🚨 shhgit ayuda a proteger a los equipos de desarrollo, operaciones y seguridad con visión de futuro al encontrar secretos en su código...

porch-pirate

Porch Pirate Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and...

apkleaks

APKLeaks Escaneando archivo APK en busca de URIs, endpoints y secretos. Instalación desde PyPi desde el código fuente desde Docker Uso Opciones Salida Patrón Argumentos para descompilador Licencia Agradecimientos Instalación Es bastante sencillo instalar APKLeaks : desde PyPi root@kitploit: $ pip...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. root@kitploit: "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com",...

cq

cq Code Query, a universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed,...

dora

dora Características Extremadamente rápido ya que utilizamos ripgrep en el backend Pasos de explotación/PoC para muchas de las claves API, lo que permite redactar un buen informe para la caza de recompensas por errores A diferencia de muchos otros buscadores de claves API, dora también muestra la...

CVE-2024-47533

CVE-2024-47533 - Exploit de RCE por Bypass de Autenticación en Cobbler XMLRPC Ejecución Remota de Código Crítica mediante Bypass de Autenticación en Cobbler Implementación del PoC. Resumen Cobbler, un servidor de instalación de Linux que permite el aprovisionamiento rápido de entornos de...

yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

CVE-2025-55449-AstrBot-RCE

Introduction AstrBot =3.5.17 hardcodes a JWT secret in the source code, allowing arbitrary plugin uploads and leading to RCE. Usage root@kitploit: python main.py 'http://127.0.0.1:6185' Source Code https://github.com/AstrBotDevs/AstrBot.git...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

apkprobe

APKprobe APK decompiler and secrets scanner for Android security research. Automatically extract API keys , endpoints , tokens , and other leaked credentials from Android applications. Works with .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab files. Perfect for apk2url extractio...

cred_scanner

credscanner أداة سطر أوامر بسيطة للعثور على بيانات اعتماد AWS في الملفات. مُحسَّنة للاستخدام مع Jenkins وأنظمة CI الأخرى. أعتقد أن هناك أدوات أخرى أفضل متاحة مثل git-secrets، لكنني لم أجد أداة تقوم بفحص سريع وغير دقيق وتتكامل جيدًا مع Jenkins أيضًا. الاستخدام: للتثبيت، ما عليك سوى نسخه إلى المكان...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

CVE-2025-8570

CVE-2025-8570 BeyondCart Connector = 2.1.0 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation 🚨 BeyondCart Connector = 2.1.0 - JWT Privilege Escalation CVE-2025-8570 🛡️ Vulnerability Overview The BeyondCart Connector plugin for WordPress, in versions 1.4.2 through 2.1.0 ...

reconix

Reconix Reconnaissance Intelligence Engine | Leak Scanner | Threat Intelligence Suite 🔍 Deep Exposure Intelligence • ⚡ High-Signal Recon Engine ⚠️ LEGAL DISCLAIMER Reconix is designed EXCLUSIVELY for authorized security testing, bug bounty programs, and defensive research. ✅ DO scan targets you ow...