Skip to content

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

CVE-2023-31664 — CVE-2023-31664 WSO2 | Kitploit

GitHub/adilkhan7/cve-2023-31664

Vulnerability Analysis Exploitation Web Application Exploitation Web Security Penetration Testing

adilkhan7/cve-2023-31664

CVE-2023-31664

CVE-2023-31664 WSO2

View Repository

333 years ago

Most Popular

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Share

CVE-2023-31664

CVE-2023-31664 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.

PoC: to exploit it only needs change the value of tenantDomain parameter from super.carbon to

Example: https://host/authenticationendpoint/login.do?client_id=..TRUNCATED...+openid&state=%2F&tenantDomain=&sessionDataKey=00000000000&relyingParty=AaAaAaAaA&type=oidc&sp=apim_admin_portal&isSaaSApp=true&authenticators=BasicAuthenticator

Reported by: na1man