CVE-2024-53476

CVE-2024-53476 विवरण SimplCommerce को चेकआउट लॉजिक में रेस कंडीशन की कमजोरी से प्रभावित किया गया है, जो एक साथ चेकआउट अनुरोधों के माध्यम से कई उपयोगकर्ताओं को स्टॉक में मौजूद उत्पादों से अधिक खरीदने की अनुमति देता है। पता लगाने की विधि एक हमलावर दो खातों का उपयोग करके सीमित स्टॉक स्टॉक = 1 वाले...

padding-oracle-attacker

padding-oracle-attacker CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI. Install Make sure Node.js is installed, then run root@kitploit: $ npm install --global padding-oracle-attacker or root@kitploit: $ yarn global add...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation root@kitploit: installrustbuster echo "Installing...

strutser

strutser यह प्रोग्राम CVE-2017-5638 की जाँच करता है। उपयोग root@kitploit: Usage of ./strutser: Usage of ./strutser: -c, --concurrency int Concurrent HTTP requests. default 10 -f, --file string File containing targets -p, --ports intSlice Ports to check. default 80 -t, --timeout int Timeout on HTT...

php-app-race-condition

تطبيق PHP ضعيف حالة سباق إعداد البيئة: root@kitploit: docker-compose up التحقق من البيئة: اختبار الاتصال: http://localhost/test.php نقطة النهاية المعرضة للخطر: http://localhost/poc.php استغلال حالة السباق: root@kitploit: echo http://localhost | nuclei -t race.yml لاحظ أنه تم خصم أقل من 1280$ من...

CVE-2026-36958

CVE-2026-36958: رفض الخدمة عبر طلبات HTTP المتزامنة معرف CVE: CVE-2026-36958 التاريخ: 2026-04-29 المكتشف: Kirubel Solomne البائع: U-SPEED المنتج: راوتر U-SPEED إصدار البرنامج الثابت: V1.0.0 CWE: CWE-400 - استهلاك غير متحكم فيه للموارد الوصف البرنامج الثابت V1.0.0 لراوتر U-SPEED عرضة لرفض الخدمة. ...

CVE-2021-41773

उपयोग root@kitploit: usage: main.py -h -f FILE -s N --timeout SECONDS optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File containing target URLs one per line -s N, --semaphore N Concurrent requests default: 10 --timeout SECONDS Request timeout in seconds...

CVE-2026-55784

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by...

GHSA-334Q-H5G3-FPXV free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

CVE-2026-55784

free5GC is an open-source 5G core network implementation. In versions 1.4.4 and earlier , the AUSF component stores per-subscriber authentication state in a global sync.Map keyed only by SUPI . Because each request unconditionally replaces the active context for that SUPI, an attacker with access...

EUVD-2026-68016

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by...

CVE-2026-82258

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

EUVD-2026-67584

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

CVE-2026-82258

SvelteKit versions from 2.38.0 up to (but not including) 2.60.1 are affected by a race condition in the query.batch feature. Under specific timing conditions, concurrent requests from different users can merge under a single request context, allowing an attacker to access sensitive data from othe...

EUVD-2026-67690

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

CVE-2026-59324

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)

The version of Apache Struts installed on the remote host is 7.2.1. It is, therefore, affected by multiple vulnerabilities in the JSON plugin, as referenced in the S2-070 and S2-071 advisories: - A component of the JSON plugin that holds per-request parsing state could be shared between concurren...

EUVD-2026-62712

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...