cirrusgo

CirrusGo A fast tool to scan SAAS,PAAS App written in Go SAAS App Support : salesforce contentful next version Note flag -o output not working install : golang 1.18Ver root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go install -v...

aura-inspector

aura-inspector This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program. Introduction aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured...

cloudsplaining

Cloudsplaining Cloudsplaining 是一个 AWS IAM 安全评估工具，用于识别违反最小权限原则的情况，并生成基于风险优先级的 HTML 报告。 示例报告 文档 完整的文档，请访问 ReadTheDocs 上的项目。 安装 速查表 示例报告 概述 Cloudsplaining 能够识别 AWS IAM 策略中违反最小权限原则的情况，并生成美观的 HTML 报告。它可以扫描您 AWS 账户中的所有策略、跨多个 AWS 账户扫描，或者扫描单个策略文件。 该工具有助于识别未使用资源约束的 IAM 操作，同时通过标记出以下无限制情况下给 AWS 账户带来风险的 IAM...

policy_sentry

Policy Sentry IAM 最小权限策略生成器。 教程 安装 包管理器 Shell 补全 步骤 1：创建模板 步骤 2：复制/粘贴 ARN 步骤 3：write-policy 命令 速查表 策略编写速查表 IAM 数据库查询速查表 本地初始化（可选） 其他用法 命令 Python 库用法 Docker Terraform 参考 文档 有关详细说明和完整文档，请访问 ReadTheDocs 上的项目。 查看 Salesforce 工程博客文章 了解 Policy Sentry。 概述 手动编写安全高效的 IAM 策略既繁琐又低效。许多基础设施即代码 IaC 开发者都有过这样的经历：...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery 请求头注入 同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时各一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（捆绑 Camel 4.20.0 ）...

SFPolDevChk

Salesforce 策略偏差检查器 由 NCC Group Plc 以开源形式发布 - https://www.nccgroup.com/ 开发者：Jerome Smith @exploresecurity 感谢 Stephen Tomkinson @neonbunny9 https://www.github.com/nccgroup/SFPolDevChk 根据 AGPL 发布 - 更多信息请参阅 LICENSE。 描述 在 Salesforce...

poc_salesforce_lightning

Salesforce Lightning 的 PoC 仅供学术目的使用 。 该工具通过 Aura Lightning 端点以访客权限转储 Salesforce 对象的数据。 代码虽然粗糙，还请见谅。 要求 Python3 用法 root@kitploit: $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r RECORDID -d -f -s Exploit Salesforce through the aura endpoint with t...

vulnreport

مشروع مهجور هذا المشروع لا تتم صيانته حالياً وقد تم التخلي عنه. Vulnreport منصة إدارة اختبارات الاختراق والأتمتة Vulnreport هي منصة لإدارة اختبارات الاختراق وإنشاء تقارير جيدة التنسيق وقابلة للتنفيذ دون الأعباء المعتادة التي تستهلك وقت مهندس الأمان. صُممت المنصة لدعم الأتمتة في كل مرحلة من مراحل...

raccoon

Raccoon：Salesforce 对象访问审计器 由 NCC Group Plc 以开源形式发布 - https://www.nccgroup.com/ 由 Jerome Smith @exploresecurity 开发（感谢 Viktor Gazdag @wucpi） https://www.github.com/nccgroup/raccoon 根据 AGPL 发布 - 更多信息请参阅 LICENSE。 描述 该工具基于有效的共享和对象设置，确定哪些配置文件（Profile）和权限集（Permission...

Merlion

Merlion: Una librería de aprendizaje automático para series temporales Tabla de contenidos 1. Introducción 2. Comparación con librerías relacionadas 3. Instalación 4. Documentación 5. Primeros pasos 1. Detección de anomalías 2. Pronóstico 6. Evaluación y benchmarking 7. Informe técnico y cómo cit...

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after ...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...

CVE-2026-15162

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

EUVD-2026-58838

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates ...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...