CVE-2020-28413_Mantis2.24.3-SQLi-SOAP

This repository does not have a README...

Oracle-Weblogic-Server-AsyncResponseService-Deserialization-Remote-Code-Execution-CVE-2019-2725

CVE-2019-2725 – Oracle WebLogic Unauthenticated Remote Code Execution Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. An easily exploitable vulnerability allows an...

CVE-2026-105115

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

refreshing-soap-exploit

This is a proof of concept for CVE-2022-41622, which is a CSRF in F5 Big-IP that leads to remote code execution. Using this is a bit finnicky, but I'll walk you through my favourite usecases. The vulnerability The core vulnerability is a cross-site request forgery in F5 Big-IP's SOAP interface,...

Exploit-CVE-2019-2725

Exploit-CVE-2019-2725 A simple exploit for CVE-2019-2725. Example Code: curl -X POST https://127.0.0.1/async/AsyncResponseService -H "Content-Type: text/xml" -d ' xx xx /bin/bash -c python -c "import...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

EUVD-2026-92019

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2023-20198

Overview This repository contains a cybersecurity case study analysing CVE-2023-20198, a critical zero-day vulnerability in Cisco IOS XE Software. The project explores how the vulnerability can be exploited via the Web UI and proposes technical, procedural, and policy-based mitigation strategies...

asf__cxf_CVE-2016-6812_3-0-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ Этот инструмент создан исключительно для образовательных целей. Несанкционированное использование вне контролируемых сред строго запрещено. CVE-2025-59287 — это критическая уязвимость удалённого выполнения кода в Microsoft Windows Server Update Services WSUS. Она вызвана...

PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

CVE-2026-105115: Missing Authentication for Critical Function

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview This is a Python-based exploit for CVE-2025-49493 , which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint. Vulnerability Details CVE ...

POC-CVE-2026-56164-exploit

CVE-2026-56164 — Microsoft SharePoint Server Authentication Bypass Exploit Critical CVSS 9.8 — Unauthenticated Privilege Escalation to Farm Administrator in Microsoft SharePoint Server Table of Contents Overview Vulnerability Details Affected Versions Architecture Diagrams Project Structure...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

cisco-cve-2023-20198-checker

Cisco CVE-2023-20198 Checker A professional vulnerability scanner for detecting CVE-2023-20198 in Cisco IOS XE devices. Tests for vulnerable SOAP/XML interfaces WSMA. Designed for authorized security assessments and network auditing. ⚠️ Legal Disclaimer FOR AUTHORIZED SECURITY TESTING ONLY This...