CVE-2022-41544

CVE-2022-41544 Script di Exploit Questo repository contiene uno script per sfruttare la vulnerabilità CVE-2022-41544 in GetSimple CMS. Lo script esegue diversi passaggi per verificare la presenza di vulnerabilità, divulgare le chiavi API, impostare i cookie, ottenere i token CSRF, caricare una...

pwned

pwned Uno strumento da riga di comando per interrogare il servizioHave I been pwned? di Troy Hunt utilizzando il modulo Node.js hibp. Installazione Scarica e installa Node.js, poi installa pwned globalmente usando npm: root@kitploit: npm install pwned -g In alternativa, puoi eseguirlo su richiest...

mantra

「🔑」 Informazioni su Mantra Il tool in questione è stato creato in Go e il suo obiettivo principale è cercare chiavi API in file JavaScript e pagine HTML. Funziona controllando il codice sorgente delle pagine web e dei file script per individuare stringhe identiche o simili a chiavi API. Queste...

keyFinder

KeyFinder Rilevamento passivo di chiavi API e segreti per Chrome e Firefox KeyFinder è un'estensione per browser per Chrome e Firefox che analizza passivamente ogni pagina visitata alla ricerca di chiavi API, token, segreti e credenziali trapelati. Funziona silenziosamente in background senza...

git-hound

🐾 GitHound Um apanhador de segredos que combina padrões, ataca patches e captura em lote. Visão Geral O GitHound caça chaves de API, segredos e credenciais expostas no GitHub combinando GitHub dorks com correspondência de padrões, detecção contextual e análise do histórico de commits. Insira um...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

run-gemini-cli

run-gemini-cli Übersicht run-gemini-cli ist eine GitHub Action, die Gemini über die Gemini CLI in deinen Entwicklungsworkflow integriert. Sie fungiert sowohl als autonomer Agent für kritische routinemäßige Programmieraufgaben als auch als bedarfsorientierter Mitarbeiter, dem du schnell Aufgaben...

cariddi

Prendi una lista di domini, esegui il crawling degli URL e scansiona per endpoint, segreti, chiavi API, estensioni di file, token e altro ancora Codice con 💙 da edoardottt Condividi su Twitter! Installazione • Utilizzo • Per iniziare • Changelog • Contribuire • Licenza Installazione 📡 Homebrew...

telegram-nearby-map

Telegram Nearby Map Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map...

CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

EUVD-2026-66395

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...

Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

EyesOfNetwork - Hardcoded API Key & SQL Injection

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php. id: CVE-2020-8656 info: name:...

Google-api-key-scanner

Übersicht Ein Python-Tool zum Testen von Google-Maps-API-Schlüsseln gegen 21 verschiedene Google-API-Endpunkte, um zu prüfen, welche Dienste offengelegt und verwundbar sind. !IMPORTANT 🎥 Für eine vollständige Vorführung des Tools schau dir das Demo-Video hier an: https://youtu.be/3KMUnLdlOSE. Das...

Gemini-api-key-hunter

Toolkit per chiavi API Gemini Un toolkit per scoprire, validare e testare chiavi API Google Gemini esposte. È composto da due componenti: Gemisc.py – Uno scanner Python ad alta velocità che scopre chiavi API Google esposte da siti web e file JavaScript, le verifica tramite l'API Gemini e identifi...