aura-inspector

aura-inspector Este no es un producto oficialmente respaldado por Google. Este proyecto no es elegible para el Programa de Recompensas por Vulnerabilidades de Software de Código Abierto de Google. Introducción aura-inspector es una navaja suiza de pruebas de Salesforce Experience Cloud. Facilita ...

cloudsplaining

Cloudsplaining Cloudsplaining es una herramienta de evaluación de seguridad de AWS IAM que identifica violaciones del principio de mínimo privilegio y genera un informe HTML priorizado por riesgo. ' custom-guidance.html ' custom-appendices.html Generar informe con contenido personalizado...

policy_sentry

Policy Sentry Generador de políticas de mínimo privilegio para IAM...

SFPolDevChk

Comprobador de Desviaciones de Políticas de Salesforce Publicado como código abierto por NCC Group Plc - https://www.nccgroup.com/ Desarrollado por Jerome Smith @exploresecurity Con agradecimientos a Stephen Tomkinson @neonbunny9 https://www.github.com/nccgroup/SFPolDevChk Publicado bajo AGPL -...

cirrusgo

CirrusGo Una herramienta rápida para escanear aplicaciones SAAS, PAAS escrita en Go Soporte de aplicaciones SAAS : salesforce contentful próxima versión Nota: el flag -o output no funciona instalación : golang 1.18Ver root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or ...

Merlion

Merlion: A Machine Learning Library for Time Series Table of Contents 1. Introduction 2. Comparison with Related Libraries 3. Installation 4. Documentation 5. Getting Started 1. Anomaly Detection 2. Forecasting 6. Evaluation and Benchmarking 7. Technical Report and Citing Merlion Introduction...

CVE-2026-49099

CVE-2026-49099 — Inyección de cabecera sObjectQuery en camel-salesforce Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime:...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage root@kitploit: $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a...

vulnreport

Proyecto Abandonado Este proyecto no recibe mantenimiento actualmente y ha sido abandonado. Vulnreport Plataforma de gestión y automatización de pentesting Vulnreport es una plataforma para gestionar pruebas de penetración y generar informes de hallazgos bien formateados y procesables sin la...

raccoon

Raccoon: auditor de acceso a objetos de Salesforce Publicado como código abierto por NCC Group Plc - https://www.nccgroup.com/ Desarrollado por Jerome Smith @exploresecurity con agradecimientos a Viktor Gazdag @wucpi https://www.github.com/nccgroup/raccoon Publicado bajo AGPL - consulte LICENSE...

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after ...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

EUVD-2026-58838

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates ...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...