Poc-CVE-2024-32962-xml-crypto

Poc-CVE-2024-32962-xml-crypto محاكاة لهجوم يستغل الثغرة CVE-2024-32962 لتزوير رسائل SAML والحصول على أذونات غير مصرح بها سيكون متاحًا قريبًا جدًا. Poc...

CVE-2024-45409

Ruby-SAML / GitLab प्रमाणीकरण बाईपास CVE-2024-45409 शोषण यह स्क्रिप्ट CVE-2024-45409 का शोषण करती है, जो IDP द्वारा जारी किसी भी हस्ताक्षरित SAML दस्तावेज़ तक पहुँच रखने वाले अप्रमाणित हमलावर को SAML प्रतिसाद/अभिकथन जाली बनाने और GitLab पर किसी भी उपयोगकर्ता के रूप में पहुँच प्राप्त करने की अनुमत...

CVE-2026-75807 SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

PT-2026-83496

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.7 Description An authentication bypass exists due to the mo saml login validate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse int...

PT-2026-81198

Attackers are forging SAML responses to bypass WordPress authentication in miniOrange SSO plugin exploits. TRC analysis shows threat actors gained admin access through CVE-2024-61979 and CVE-2024-15981, then escalated privileges within compromised CMS environments. Runtime segmentation helps...

PT-2026-81197

Attackers are forging SAML responses to bypass WordPress authentication in miniOrange SSO plugin exploits. TRC analysis shows threat actors gained admin access through CVE-2024-61979 and CVE-2024-15981, then escalated privileges within compromised CMS environments. Runtime segmentation helps...

CVE-2026-55789

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into...