raccoon

Raccoon: revisore dell'accesso agli oggetti Salesforce Rilasciato come open source da NCC Group Plc - https://www.nccgroup.com/ Sviluppato da Jerome Smith @exploresecurity con ringraziamenti a Viktor Gazdag @wucpi https://www.github.com/nccgroup/raccoon Rilasciato sotto AGPL - fare riferimento a...

SFPolDevChk

Salesforce-Richtlinienabweichungsprüfer Als Open Source veröffentlicht von NCC Group Plc - https://www.nccgroup.com/ Entwickelt von Jerome Smith @exploresecurity Mit Dank an Stephen Tomkinson @neonbunny9 https://www.github.com/nccgroup/SFPolDevChk Veröffentlicht unter AGPL - siehe LICENSE für...

cloudsplaining

Cloudsplaining Cloudsplaining è uno strumento di valutazione della sicurezza IAM AWS che identifica violazioni del principio del minimo privilegio e genera un report HTML con priorità di rischio...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

cirrusgo

CirrusGo Uno strumento veloce per scansionare app SAAS, PAAS scritto in Go Supporto per app SAAS : salesforce contentful prossima versione Nota: il flag -o per l'output non funziona installazione : golang 1.18Ver root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go...

policy_sentry

Policy Sentry IAM Least Privilege Policy Generator...

aura-inspector

aura-inspector Questo non è un prodotto ufficialmente supportato da Google. Questo progetto non è idoneo per il Programma di ricompense per vulnerabilità del software open source di Google. Introduzione aura-inspector è un coltellino svizzero per il testing di Salesforce Experience Cloud. Facilit...

Merlion

Merlion: Eine Machine-Learning-Bibliothek für Zeitreihen Inhaltsverzeichnis 1. Einführung 2. Vergleich mit verwandten Bibliotheken 3. Installation 4. Dokumentation 5. Erste Schritte 1. Anomalieerkennung 2. Prognose 6. Evaluierung und Benchmarking 7. Technischer Bericht und Zitieren von Merlion...

poc_salesforce_lightning

Salesforce lightning के लिए PoC केवल शैक्षणिक उद्देश्यों के लिए। यह टूल अतिथि विशेषाधिकार के साथ Aura lightning endpoint के माध्यम से Salesforce object का डेटा डंप करता है। यह अस्त-व्यस्त कोड है, पर माफ कर दो। आवश्यकता Python3 उपयोग root@kitploit: $ python3 exploit.py -h usage: exploit.py -h -u U...

vulnreport

Progetto Abbandonato Questo progetto non è attualmente mantenuto ed è stato abbandonato. Vulnreport Piattaforma di gestione e automazione dei penetration test Vulnreport è una piattaforma per la gestione dei penetration test e la generazione di report di findings ben formattati e utilizzabili,...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...

EUVD-2026-58838

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates ...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...

Malicious code in @onereach/salesforce-miaw-client (npm)

npm/@onereach/salesforce-miaw-client is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized an...