9 matches found
CVE-2025-12101-Scanner-PoC
CVE-2025-12101 스캐너 CVE-2025-12101 - SAML RelayState를 통한 Citrix NetScaler XSS 취약점을 위한 멀티스레드 스캐너입니다. 개요 CVE-2025-12101은 Citrix NetScaler ADC 및 Gateway 제품에서 RelayState 매개변수를 통해 /cgi/logout 엔드포인트에 영향을 미치는 반사형 XSS 취약점입니다. CVSS 점수: 5.9 중간 기능 ✅ 단일 호스트 -u 또는 다중 호스트 -f 스캔 ✅ 멀티스레드 스캔 1-100 스레드 ✅ 고유 페이로드 검증...
CVE-2026-86756
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...
CVE-2026-86756
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters, and LoginCon...
CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...
CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...
CVE-2025-12101-checker
CVE-2025-12101-checker Citrix NetScaler ADC / Gateway 인스턴스에서 CVE-2025-12101 /cgi/logout에서 반사 XSS를 확인하기 위한 간단한 Python PoC입니다. 조작된 SAMLResponse + RelayState 페이로드를 사용합니다. ⚠️ 이 도구는 귀하가 소유하거나 명시적으로 테스트 승인을 받은 시스템에서만 사용하십시오. 🔍 Background CVE-2025-12101은 NetScaler ADC 및 NetScaler Gateway가 Gateway 또는 AAA...
CVE-2026-80200
Kimai versions before 2.53.0 contain an open redirect in the SAML authentication success handler (SamlAuthenticationSuccessHandler.php). The RelayState POST parameter is used as a redirect destination without validating the host or scheme, so any absolute URL passes the sole check (it must not eq...
CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...