EyouCMS 1.5.4 Open Redirect

EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function. id: CVE-2021-39501 info: name: EyouCMS 1.5.4 Open Redirect author: 0xAkoko severity: medium description: EyouCMS 1.5.4 is vulnerable to an Open Redirect...

UC Gateway Investment SiteEngine v5.0 - Open Redirect

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action. id: CVE-2008-7269 info: name: UC Gateway Investment SiteEngine v5.0 - Open...

Microweber < 1.2.11 - Open Redirection

Open Redirect in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0597 info: name: Microweber 1.2.11 - Open Redirection author: Farish severity: medium description: | Open Redirect in Packagist microweber/microweber prior to 1.2.11. impact: | Attackers can redirect users to malicious...

User Registration & Membership WordPress plugin - Open Redirect

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. id: CVE-2026-6203 info: name: User...

CVE-2023-2822-demo

CVE-2023-2822-demo CVE-2023-2822をデモするための意図的に脆弱なWebアプリを実装するシンプルなflaskアプリケーション。 以下の解説記事に基づいています: https://medium.com/@cyberninja717/reflected-cross-site-scripting-vulnerability-in-ellucian-ethos-identity-cas-logout-page-685bb1675dfb。 docker build -t xss-demo . docker run -p :5000 xss-demo 🤖 AILレベル:...

CVE-2019-13497

CVE-2019-13497 エクスプロイトタイトル: Cross Site Request Forgery CSRF 日付: 07/10/2019 エクスプロイト作成者: Furqan Khan ベンダーホームページ: https://www.oneidentity.com/ ソフトウェアリンク: https://www.oneidentity.com/products/cloud-access-manager/ バージョン: 8.1.3 テスト環境: Kali Linux , Windows 7 ,Ubantu 16.04...

CVE-2025-56643

CVE-2025-56643 CVE-2025-56643 の公開リファレンス – Wiki.js 2.5.307 JWT セッション脆弱性 説明: Requarks Wiki.js 2.5.307 は、ユーザーがログアウトしたときにアクティブな JWT トークンを適切に取り消したり無効にしたりしません。 その結果、以前に発行されたトークンは有効なままであり、ログアウト後もシステムにアクセスするために再利用される可能性があります。 この動作はセッションの整合性に影響を与え、トークンが侵害された場合に不正アクセスを許す可能性があります。...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 スキャナー CVE-2025-12101 のマルチスレッド脆弱性スキャナー - SAML RelayState 経由の Citrix NetScaler XSS。 概要 CVE-2025-12101 は、Citrix NetScaler ADC および Gateway 製品における反射型 XSS 脆弱性であり、RelayState パラメータを介して /cgi/logout エンドポイントに影響を与えます。 CVSS スコア: 5.9 中 機能 ✅ 単一ホスト -u または複数ホスト -f のスキャン ✅ マルチスレッドスキャン 1～100 スレッド ✅...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

SummaryThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network,...

Rocky Linux 8 [CIQ] Security Update: mod_auth_mellon / mod_auth_mellon-debuginfo / etc (crlsa-2022_1934)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221934 advisory. modauthmellon: Open Redirect vulnerability in logout URLs CVE-2021-3639 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel Multiple Vulnerabilities (crlsa-2020_3032)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20203032 advisory. modauthopenidc: Open redirect in logout url when using URLs with leading slashes CVE-2019-14857 modauthopenidc: Open redirect issue exists in URLs with sla...

CVE-2023-30212-Lab

CVE-2023-30212-Lab 包含 Dockerfile 和文件的 GitHub 仓库，用于创建 CVE-2023-30212 的漏洞环境，以便探索该安全漏洞的可利用性。非常适合研究人员和安全爱好者在一个受控环境中研究和理解该漏洞的影响。 下载此仓库： git clone https://github.com/mallutrojan/CVE-2023-30212-Lab.git 进入目录： Cd CVE-2023-30212-Lab 赋予执行权限： chmod u+x lab.sh 运行脚本： ./lab.sh 访问 http://localhost 并使用密码设置用户...

CVE-2025-12101-checker

CVE-2025-12101-checker Citrix NetScaler ADC / Gateway インスタンスが CVE-2025-12101 （/cgi/logout における反射型XSS）に対して脆弱かどうかをチェックする、シンプルな Python PoC です。細工された SAMLResponse + RelayState ペイロードを使用します。 ⚠️ このツールは、自分が所有するシステム、または明示的にテストを許可されたシステムでのみ使用してください。 🔍 背景 CVE-2025-12101 は、NetScaler ADC および NetScaler Gateway が...

CVE-2026-71981

Cypht CVE-2026-71981 PoC 这是针对 CVE-2026-71981 不安全反序列化远程代码执行漏洞的概念验证（PoC）。执行命令的结果会打印在登出请求的响应中，位于 标签之后。使用 --print-all 参数可同时打印完整响应。 受影响版本： v2.12.2 安装依赖并执行 该脚本需要安装 https://github.com/ambionics/phpggc 以生成 unserialize 载荷。 配置与示例： python3 -m venv .venv source ./.venv/bin/activate python3 -m pip install -r...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

BIT-AIRFLOW-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006

Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to a security bypass where attacker-controlled HTML in inbound emails or tickets can circumvent the image URL sanitizer . By using path traversal sequences , an attacker can cause the browser to resolve a URL to a protected API end...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

EUVD-2026-87270

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...