CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

CVE-2024-41276

CVE-2024-41276 Kaiten 認証バイパス Kaiten - ワークフロー管理システム。 Kaiten の脆弱性により、攻撃者は PIN コード認証機構をバイパスできます。このアプリケーションは、ログイン認証情報を入力した後、ユーザーにメールで送信された 6 桁の PIN コードの入力を要求します。しかし、リクエスト制限機構は簡単にバイパスでき、攻撃者はブルートフォース攻撃で正しい PIN を推測し、アプリケーションへの不正アクセスを獲得できます。 詳細: 認証機構はメールで送信される 1 要素のみを使用し、パスワードはありません : レート制限のバイパスは...

CVE-2026-79303

CVE-2026-79303 ブール型ブラインドSQLインジェクション 説明 : 必要なデータ検証を行わず、パラメータ化されたステートメントやストアドプロシージャを使用せずに動的SQLステートメントが生成されます。 影響 : SQLi CVSSv3.1ベクター : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 9.9 Critical CWE : CWE-89: SQLコマンドで使用される特殊要素の不適切な無害化（'SQLインジェクション'） 影響を受けるコンポーネント : GETパラメータ orderby および orderdirection ベンダー :...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-79303

The kaiten project management tool (versions 57.192.20 to before 57.214.26 ) is vulnerable to a Boolean-blind SQL Injection (CWE-89). The root cause is the Hibernate query service implementation, which generates dynamic SQL statements without proper data validation, parameterized statements, or s...

CVE-2026-79303: Improper Neutralization of Special Elements used in an SQL Command

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

EUVD-2026-78816

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

Exploit for CVE-2026-00000

CVE-2026-00000 Boolean-blind SQL injection Description...

Exploit for CVE-2026-79303

CVE-2026-79303 Boolean-blind SQL injection Description...

CVE-2024-41276

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. However, the request limiting mechanis...

The vulnerability of the Hibernate query service implementation in the Kaiten project management system lies in the lack of protective measures for the SQL query structure. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Hibernate query service implementation in the Kaiten project management tool is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of th...

CVE-2024-39211

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...

PT-2025-62963

Name of the Vulnerable Software and Affected Versions Kaiten versions 57.192.20 through 57.214.25 Description The Hibernate request service in the project management tool contains a flaw where dynamic SQL statements are generated without proper data validation, parameterized statements, or stored...

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks

Cybersecurity researchers are warning about a spike in malicious activity that involves roping vulnerable D-Link routers into two different botnets, a Mirai variant dubbed FICORA and a Kaiten aka Tsunami variant called CAPSAICIN. "These botnets are frequently spread through documented D-Link...

CVE-2024-41276

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. However, the request limiting mechanis...

Kaiten 安全漏洞

Kaiten is an employee management platform from Kaiten Inc. A security vulnerability exists in Kaiten version 57.131.12 and prior versions, which stems from a vulnerability that allows an attacker to bypass the PIN authentication mechanism, enabling the attacker to perform a brute force attack to...

CVE-2024-41276

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. However, the request limiting mechanis...

CVE-2024-41276

The workflow management system Kaiten (versions 57.131.12 and earlier ) is vulnerable to a PIN code authentication bypass . The application requires a 6-digit email-sent PIN for authorization, but the request limiting mechanism can be bypassed using the X-Forwarded-For header to reset the X-RateL...