CVE-2026-63713

The Toptech TMS7 and TopHAT systems are vulnerable to a time-based blind SQL injection vulnerability. This security flaw exists within the "search" parameter of the view audit logs feature, located in the utilities section. Impacting the confidentiality and availability of the system, the vulnera...

CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

Microsoft-2024-December-Update-Control

Script de Verificación de Parches de Seguridad de Windows Diciembre 2024 Este script de PowerShell verifica si las actualizaciones KB necesarias para vulnerabilidades específicas anunciadas en los boletines de seguridad de Microsoft de diciembre de 2024 CVE-2024-49124, CVE-2024-49117,...

CVE-2026-59827

Herramienta autorizada de pruebas de penetración para Metabase CVE-2026-59827 Una utilidad de evaluación de seguridad autorizada para validar la presencia de CVE-2026-59827 en implementaciones de Metabase durante proyectos aprobados de pruebas de penetración. Esta herramienta está diseñada para...

Web-App-PenTesting

🚀 Inicio Rápido 1. Clonar el repositorio git clone https://github.com/Sarthak4126/Web-App-PenTesting.git cd Web-App-PenTesting/targetapp 2. Instalar dependencias pip install -r requirements.txt 3. Iniciar la aplicación objetivo python app.py La aplicación se ejecuta en: http://127.0.0.1:5000 4...

How we found 24 Android vulnerabilities using our open source AI security agent

With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work. In this blog post, I'll share how I created auditing...

sentrygrid

SentryGrid Plataforma de detección de amenazas impulsada por ML y monitoreo continuo construida para arquitecturas federales de confianza cero. Nativa de OSCAL, alineada con FedRAMP Moderate, auditoría encadenada por hash, ensamble de anomalías de tres modelos. Inicio rápido make setup install bu...

CVE-2021-3130

CVE-2021-3130 Descripción sugerida Dentro de la aplicación Open-AudIT hasta la versión 4.0.2, la interfaz web oculta secretos SSH, contraseñas de Windows y cadenas SNMP de los usuarios mediante la ofuscación del 'campo de contraseña' HTML. Usando herramientas de desarrollador o similares, es...

database-sentinel

🛡️ Database Sentinel（数据库哨兵） 一个用于审计数据库后端安全漏洞的 Claude 技能。 将其放入 Claude Code、Cursor 或任何基于 Claude 的环境中。说“审计我的数据库”，即可获得一份全面的安全报告以及精确的修复代码——只需几分钟，而非数天。 超过 170 个 Lovable 应用遭到入侵。 YC 初创公司中 2010 万行数据被暴露。约 87,000 个 MongoDB 实例易受 MongoBleed 攻击（CVE-2025-14847，CISA KEV）。仅在 2025 年的一次事件中就有 180 万个 Firebase 密码泄露。45% ...

macOS_security_audit

🔒 macOS Security Audit A Bash-based security auditing toolkit for macOS that checks system hardening settings against CIS Benchmark recommendations and generates JSON/HTML reports. Created by Bartłomiej Pogwizd · https://www.youtube.com/@pTech-pl Overview This toolkit consists of two scripts:...

sshfinder

sshfinder 发现网络上的每一个 SSH 服务，判断其是否符合你的标准，并在发生变化时收到通知。 sshfinder 是一个无第三方依赖的单一 Python 文件。将其指向一个 CIDR 网段，它就能发现 SSH 实际监听的任何位置——不仅仅是 22 端口——确认每个服务确实在运行 SSH 协议，评估其加密安全态势，并在有服务不符合你的策略时返回非零退出码。 它解决的问题 大多数团队无法回答关于自身 SSH 资产状况的三个问题： 1. 我们有多少 SSH 服务，它们在哪里？ 不是问有多少台机器——而是问有多少个 正在监听的 SSH 服务 ，包括那个承包商在 2019 年搭建在 22...

Nessus_CVE-2014-6271_check

NessusCVE-2014-6271check Archivo .audit de nessus rápido y sucio para comprobar si bash es vulnerable a CVE-2014-6271...

CVE-2021-35576

CVE-2021-35576 CVE-2021-35576 绕过Oracle统一审计的安全漏洞，概念验证详情发布在此：https://databasesecurityninja.wordpress.com/2022/06/11/cve-2021-35576-bypassing-unified-audit-policy/ CVE详情：https://vulners.com/cve/CVE-2021-35576...

DiffCatcher

支持开发 如果本项目对您的工作有帮助，请支持我们的持续维护和新特性开发。 ETH 捐赠钱包 0x11282eE5726B3370c8B480e321b3B2aA13686582 扫描二维码或复制上方钱包地址。 一个 Rust CLI 工具，用于递归发现 Git 仓库、捕获状态变化、生成差异、提取带完整代码片段的代码元素，并生成面向安全审计的代码审查报告。 🎯 主要特性 仓库发现 ：递归扫描目录中的 Git 仓库，支持可配置过滤器 状态跟踪 ：捕获拉取前后的状态，包括提交哈希、提交消息和脏状态检测 差异生成 ：自动生成 N vs N-1 和历史差异，附带文件清单 元素提取...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-86066

The HR and CRM software Horilla is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 2.0.0 . The approve_validate_attendance_request function at /attendance/approve-validate-attendance-request/ performs state-changing actions (such as updating attendance_validated and ap...

CVE-2026-85290

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...