autoSource

AutoSource AutoSource est un framework automatisé de revue de code source intégré à SonarQube, capable d'effectuer des analyses/reviews statiques de code. Il peut être utilisé pour trouver efficacement les vulnérabilités dès les premières étapes du SDLC Software Development Life Cycle...

wpbullet

wpBullet Une analyse statique de code pour les plugins/thèmes WordPress et PHP Installation Clonez simplement le dépôt, installez les dépendances et exécutez le script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python...

awesome-nodejs-security

精心整理的 Node.js 安全资源精选列表。 从 Liran Tal 学习 Node.js 安全编码技术和最佳实践 目录 工具 Web 框架强化 静态代码分析 动态应用安全测试 输入输出验证 安全组合 CSRF 漏洞与安全公告 安全加固...

checkov

...

vulnhuntr

LLM과 정적 코드 분석을 사용하여 원격으로 악용 가능한 취약점을 식별하는 도구입니다. 세계 최초로 자율 AI가 발견한 0데이 취약점 설명 Vulnhuntr은 LLM의 힘을 활용하여 원격 사용자 입력에서 시작하여 서버 출력으로 끝나는 전체 코드 호출 체인을 자동으로 생성 및 분석함으로써, 기존 정적 코드 분석 도구가 수행할 수 있는 범위를 훨씬 넘어서는 복잡하고 다단계이며 보안을 우회하는 취약점을 탐지합니다. 모든 0데이에 대한 Vulnhuntr 출력을 포함한 모든 세부 사항은 여기에서 확인하세요: Protect AI...

androguard

Androguard Do you think your phone has been pwned ? please check IsMyPhonePwned New tool: Goauld Dynamic injection tool for Linux/Android See the new version of Androguard: https://github.com/androguard/androguard/tree/ng Installation Quick installation: root@kitploit: pip install androguard...

StaCoAn

StaCoAn Больше не поддерживается! Скоро будет архивирован. StaCoAn — это кроссплатформенный инструмент, помогающий разработчикам, охотникам за багами и этичным хакерам проводить статический анализ кода мобильных приложений. Этот инструмент будет искать в коде интересные строки, которые могут...

cve-2020-29007

Идентификатор CVE : CVE-2020-29007 Название затронутого продукта и версии : Mediawiki Score все версии до 0.3.0 Тип проблемы : CWE-96: Неправильная нейтрализация директив в статически сохранённом коде «Статическая инъекция кода» Сводка Score — это расширение Mediawiki, которое генерирует нотную...

kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...

apkvuln

ApkVuln root@kitploit: \ / \ / \ / \ / \ /\ \ \ \ /|\ \ \ | | | \ | |/ /\ \ / / | | | | | | | / \ | / ' \ V /| || | || . | // \|| |\ / /|||| ApkVuln을 사용하면 APK의 .java 파일을 얻고, 코드 내에서 정규 표현식을 사용하여 잠재적 취약점을 찾기 위해 분석합니다. 참고 : 결과의 정확성은 정규 표현식에 따라 달라집니다. 정규 표현식은 사용자 정의가 가능합니다. 의존성 이 앱을 실행하려면 Python...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

static-code-analysis-helper

Static-Code-Analysis-Helper Описание Он обнаруживает функции, которые могут привести к векторам атак во многих языках веб-программирования и фреймворках в папке вашего проекта. Помогает выполнять статический анализ кода. Примечание. Многие из описанных здесь функций могут не приводить к...

whispers

Whispers « Mes petits oiseaux sont partout, même dans le Nord, ils me murmurent les histoires les plus étranges. » – Lord Varys Whispers est un outil d'analyse statique de code conçu pour analyser divers formats de données courants à la recherche d'informations d'identification codées en dur et d...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54271 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static outp...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the pbjs static code generation. An attacker can execute arbitrary code by providing crafted schema names that are incorporated into generated JavaScript output, which is then executed or imported by the...

GHSA-PR59-H9PH-3FR8 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

Summary A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas fro...

PT-2026-49586

Name of the Vulnerable Software and Affected Versions protobufjs-cli versions prior to 1.3.2 protobufjs-cli versions prior to 2.5.0 Description An incomplete fix for unsafe name handling in pbjs static and static-module code generation allows the emission of unsafe JavaScript references when...