CVE-2019-19781-DFIR-Notes

Based on a Splunk perspective. Below resources show that ingesting your logs is essential from proper analysis of the Indicators Of Compromise Never waste a good crisis...ingest all the logs! Impact / Root Cause: Remote pre-auth arbitrary command execution due to logic vuln i.e. reliable executio...

CVE-2023-4966

CVE-2023-4966 Exploit Script CVE-2023-4966 - NetScaler ADC and NetScaler Gateway Memory Leak Exploit Usage: usage: python banner.py optional arguments: -h, --help show this help message and exit --target TARGET The Citrix ADC / Gateway target, excluding the protocol e.g. 192.168.1.200...

cve-2025-5777

CitrixBleed2 - CVE-2025-5777 PoC Scanner This repository contains an advanced Proof of Concept PoC scanner for CVE-2025-5777 , dubbed CitrixBleed2 , a memory disclosure vulnerability affecting Citrix NetScaler ADC and Gateway. I did some changes to the original poc, this script is based on resear...

CVE-2019-19781-Citrix

This repository does not have a README...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerabili...

massCitrix

massCitrix Code developed for mass verification of the CVE-2019-19781 vulnerability on hosts discovered by Shodan. Pull requests are welcome...

CVE-2025-5777

CVE-2025-5777 - Citrix NetScaler Memory Leak PoC 📌 Description This script exploits a critical memory disclosure vulnerability in Citrix NetScaler ADC/Gateway appliances, identified as CVE-2025-5777 dubbed CitrixBleed 2. It triggers a memory leak through the /p/u/doAuthentication.do endpoint,...

CVE-2023-3519

CVE-2023-3519 identify NetScaler Citrix ADC servers vulnerable to CVE-2023-3519 Ported to python from https://github.com/mr-r3b00t/CVE-2023-3519 Not tested. use at your own risk...

ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...

Citrix SD-WAN and NetScaler SD-WAN - SQL Injection

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database...

Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. This bug is nearly identical to the Citrix Bleed...

citrix-ioc-scanner-cve-2023-3519

Indicator of Compromise Scanner for CVE-2023-3519 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2023-3519. The utility, and its resources, encode indicators of compromise collected during Mandiant investigations. To learn more, please read th...

Citrix Security Advisory for CVE-2026-109618 and CVE-2026-109619

Cloud Software Group is aware of the following vulnerabilities affecting PHP RCE via OOM corruption, CVE-2026-109618 RCE via stale global state, CVE-2026-109619 The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or m...

Citrix Gateway and Citrix ADC - Cross-Site Scripting

Citrix ADC and Citrix Gateway versions before 13.1 and 13.1-45.61, 13.0 and 13.0-90.11, 12.1 and 12.1-65.35 contain a cross-site scripting vulnerability due to improper input validation. id: CVE-2023-24488 info: name: Citrix Gateway and Citrix ADC - Cross-Site Scripting author: johnk3r,DhiyaneshD...

Citrix XenServer 8.4.x / 9.x Multiple Vulnerabilities (CTX697170)

The version of Citrix XenServer installed on the remote host is 8.4.x or 9.x. It is, therefore, affected by multiple vulnerabilities as referenced in the CTX697170 advisory: - A grant table race on a v2 - v1 - v2 version change may allow a privileged user in a guest VM to compromise or crash the...

Citrix XenServer 8.4.x Page Reference Leak (CTX697170)

The version of Citrix XenServer installed on the remote host is 8.4.x. It is, therefore, affected by a vulnerability as referenced in the CTX697170 advisory: - The grant table cache-flush error path fails to drop a page reference, which may allow a privileged user in a guest VM to compromise or...

Citrix Workspace App for Windows Out-of-bounds Write (CVE-2026-84419) (CTX697181)

The version of Citrix Workspace App for Windows installed on the remote host is 2507.1 LTSR prior to 2507.1 LTSR CU3 Hotfix 1, or Current Release prior to 2603.20, or 2607 LTSR prior to 2607 LTSR Hotfix 1. It is, therefore, affected by an out-of-bounds write vulnerability as referenced in the...

Citrix Workspace App for Windows Out-of-bounds Read and Write (CVE-2026-84420) (CTX697181)

The version of Citrix Workspace App for Windows installed on the remote host is 2507.1 LTSR prior to 2507.1 LTSR CU3, or Current Release prior to 2603.20. It is, therefore, affected by an out-of-bounds read and out-of-bounds write vulnerability as referenced in the CTX697181 advisory. -...