CVE-2025-12101-checker

CVE-2025-12101-checker Citrix NetScaler ADC / Gateway 인스턴스에서 CVE-2025-12101 /cgi/logout에서 반사 XSS를 확인하기 위한 간단한 Python PoC입니다. 조작된 SAMLResponse + RelayState 페이로드를 사용합니다. ⚠️ 이 도구는 귀하가 소유하거나 명시적으로 테스트 승인을 받은 시스템에서만 사용하십시오. 🔍 Background CVE-2025-12101은 NetScaler ADC 및 NetScaler Gateway가 Gateway 또는 AAA...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 スキャナー CVE-2025-12101 のマルチスレッド脆弱性スキャナー - SAML RelayState 経由の Citrix NetScaler XSS。 概要 CVE-2025-12101 は、Citrix NetScaler ADC および Gateway 製品における反射型 XSS 脆弱性であり、RelayState パラメータを介して /cgi/logout エンドポイントに影響を与えます。 CVSS スコア: 5.9 中 機能 ✅ 単一ホスト -u または複数ホスト -f のスキャン ✅ マルチスレッドスキャン 1～100 スレッド ✅...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Citrix Netscaler_Application_Delivery_Controller

Citrix NetScaler SAML nFactor Context Authentication Bypass —...

CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters, and LoginCon...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-80200

Kimai versions before 2.53.0 contain an open redirect in the SAML authentication success handler (SamlAuthenticationSuccessHandler.php). The RelayState POST parameter is used as a redirect destination without validating the host or scheme, so any absolute URL passes the sole check (it must not eq...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-54714

Technical details about CVE-2026-54714 are not publicly available in the provided documents. Monitor for updates from Logto advisories and releases.

CVE-2026-54714: Improper Neutralization of Input During Web Page Generation

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...