php-app-race-condition

脆弱なPHPアプリ（競合状態） 環境構築: root@kitploit: docker-compose up 環境検証: 接続テスト: http://localhost/test.php 脆弱なエンドポイント: http://localhost/poc.php 競合状態のエクスプロイト: root@kitploit: echo http://localhost | nuclei -t race.yml 残高から引き出しとして計上されたのは1280$未満であることが確認できます（10$ 128リクエスト）。純利益は変動します。 参考:...

padding-oracle-attacker

padding-oracle-attacker 패딩 오라클 공격을 쉽게 실행할 수 있는 CLI 도구 및 라이브러리입니다. 동시 네트워크 요청과 우아한 UI를 지원합니다. 설치 먼저 Node.js가 설치되어 있는지 확인한 후 다음 명령어를 실행하세요. root@kitploit: $ npm install --global padding-oracle-attacker 또는 root@kitploit: $ yarn global add padding-oracle-attacker CLI 사용법 root@kitploit: Usage $...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation root@kitploit: installrustbuster echo "Installing...

CVE-2026-36958

CVE-2026-36958: 同時HTTPリクエストによるサービス拒否 CVE ID: CVE-2026-36958 日付: 2026-04-29 発見者: Kirubel Solomne ベンダー: U-SPEED 製品: U-SPEED ルーター ファームウェアバージョン: V1.0.0 CWE: CWE-400 - 制御されないリソース消費 説明 U-SPEED ルーターのファームウェア V1.0.0 はサービス拒否に対して脆弱です。Web管理インターフェース上のランダムまたは存在しないエンドポイントに対して大量の同時HTTPリクエストを送信することで、攻撃者は組み込みの Boa...

CVE-2021-41773

使い方 root@kitploit: usage: main.py -h -f FILE -s N --timeout SECONDS optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File containing target URLs one per line -s N, --semaphore N Concurrent requests default: 10 --timeout SECONDS Request timeout in seconds default...

strutser

strutser このプログラムは CVE-2017-5638 をチェックします。 使い方 root@kitploit: Usage of ./strutser: Usage of ./strutser: -c, --concurrency int Concurrent HTTP requests. default 10 -f, --file string File containing targets -p, --ports intSlice Ports to check. default 80 -t, --timeout int Timeout on HTTP requests...

CVE-2024-53476

CVE-2024-53476 설명 SimplCommerce는 결제 로직에 경쟁 조건 취약점이 존재하여, 여러 사용자가 동시 결제 요청을 통해 재고보다 더 많은 제품을 구매할 수 있습니다. 탐지 방법 공격자는 재고가 제한된재고 = 1 제품을 두 개의 계정을 사용하여 거의 동시에 구매하려고 시도함으로써 이 취약점을 탐지할 수 있습니다. 두 계정 모두 제품 구매에 성공하면 경쟁 조건이 존재함을 확인할 수 있습니다. 이는 사용자 정의 스크립트나 Burp Suite turbo intruder를 사용하여 동시 결제 요청을 보내 수행할 수...

CVE-2026-93840: Improper Validation of Array Index

vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...

CVE-2026-45720

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-86766

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

EUVD-2026-74921

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-87816

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

EUVD-2026-74842

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

PT-2026-88954

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire after views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...