cve-2017-5941-poc-docker-lab

CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

CVE-2026-44963

CVE-2026-44963 — Veeam备份与复制远程代码执行漏洞 由SentinelX 维护的研究仓库 — 仅用于授权的安全测试和防御目的。 概述 字段| 详情 ---|--- CVE ID| CVE-2026-44963 供应商| Veeam 产品| Backup & Replication 受影响版本| 12.3.2.4854（所有 v12 构建版本） 修复版本| 12.3.2.4854 CVSS v4 评分| 9.4 — 严重 CVSS v3 评分| 8.8 — 高危 CWE| CWE-502（不可信数据反序列化） 发现者| Sina Kheirkhah @ WatchTow...

cotonti-commentswidget-poc

PoC de inyección de objetos PHP en Cotonti CommentsWidget Prueba de concepto local segura para el problema de inyección de objetos PHP identificado en la implementación de CommentsWidget de Cotonti. Vulnerabilidad Proyecto: Cotonti Componente afectado: plugins/comments/inc/CommentsWidget.php CWE:...

CVE-2025-64512-pdfminer-PoC

CVE-2025-64512 — PoC de deserialización de CMapDB en pdfminer.six Prueba de concepto de una vulnerabilidad de deserialización en pdfminer.six que conduce a la ejecución de código arbitrario al analizar un PDF manipulado. PROPÓSITO / AVISO LEGAL Este repositorio se proporciona solo con fines...

CVE-2026-50522

🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation Critical SharePoint Deserialization Vulnerability Under Active Exploitation Created by Pratik Chhetri Report Date: 2026-07-27 📌 Executive Snapshot...

CVE-2026-68771_exploit

CVE-2026-68771 — RCE no autenticado por deserialización de pickle en ComfyUI Ejecución remota de código no autenticada en ComfyUI a través del nodo LoadTrainingDataset. LoadTrainingDataset.execute carga los shards del dataset desde el directorio de salida del servidor con torch.loadf y...

CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-Informe-Escrito-Post-Incidente Este informe post-incidente analiza la explotación de CVE-2026-20131, una vulnerabilidad crítica de Ejecución Remota de Código RCE no autenticada de día cero en Cisco Secure Firewall Management Center FMC. El documento cubre el vector de intrusión...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

CVE-2025-53770

CVE-2025-53770 Detection Project A comprehensive vulnerability detection toolkit for identifying systems vulnerable to CVE-2025-53770 CWE-502: Deserialization of Untrusted Data. 🔍 Overview This project provides enterprise-ready detection scripts to identify and assess systems potentially vulnerab...

CVE-2025-68664-LangGrinch-PoC

!CWEhttps://img.shields.io/badge/CWE--502-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-informational?style=for-the-badge&logo=owasp&logoColor=whit...

langgrinch-cve-2025-68664-analysis

LangGrinch Vulnerability Analysis: CVE-2025-68664 Overview This repository contains a technical report analyzing CVE-2025-68664, also known as LangGrinch, a serialization injection vulnerability affecting LangChain Core. The report explains the vulnerability background, root cause, exploitation...

EUVD-2026-67870

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

Security Bulletin: IBM Terracotta is affected by Logback vulnerabilities that could allow deserialization of untrusted data resulting in object injection

Summary IBM Terracotta uses Logback for logging purposes within the product. Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent

Summary Vulnerabilities in IBM SDK Java Technology Edition that is shipped as part of agent framework in ITCAM for Applications WebSphere MQ Monitoring Agent. CVEs: CVE-2026-41254, CVE-2026-47057, CVE-2026-47058, CVE-2026-47063 and CVE-2026-8400 Vulnerability Details CVEID:CVE-2026-47057...

CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

PT-2026-77211

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...