254 matches found
zap-scripts
zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: root@kitploit: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to u...
beef
=============================================================================== root@kitploit: Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com See the file 'doc/COPYING' for copying permission...
scorecard
OpenSSF Scorecard...
reversemap
reversemap Analyse SQL injection attempts in web server logs The program can either be run in batch mode or interactive mode. In batch mode the program will accept Apache web server logs and will deobfuscate requested URLs from the logs. In interactive mode the program will prompt for user input...
templates
Berichtsvorlagen Hinweise zur Verzeichnisstruktur: Das Skript generate-directories.py holt die aktuelle neueste Version der VRT-Struktur von GitHub und erstellt alle fehlenden Verzeichnisse. Es entfernt oder benennt keine Verzeichnisse basierend auf Einträgen, die aus der VRT entfernt wurden. Das...
payloads
payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
EUVD-2026-51853
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
CVE-2026-67308
Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one ...
GHSA-V96J-25GV-G2W9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...
CVE-2026-44359
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...
CVE-2026-44359
The CVE describes a flaw in Meshtastic’s GitHub workflow (main_matrix.yml) prior to version 2.7.21.1370b23 where pull_request_target could trigger jobs that check out attacker forks and execute attacker-controlled files with repository secrets and elevated GITHUB_TOKEN permissions. External PRs w...
CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...
PT-2026-61516
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main matrix.yml workflow is triggered by pull request target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevate...
CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionall...