CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

org.apache.mina:mina-example (2.0.0-m1), org.apache.mina:mina-integration-jmx (2.0.0-m1) +13 more potentially affected by CVE-2026-113730 via ognl:ognl (2.7.1)

ognl:ognl MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ognl:ognl and may be impacted: - org.apache.mina:mina-example 2.0.0-m1 - org.apache.mina:mina-integration-jmx 2.0.0-m1 - org.apache.mina:mina-integration-ognl 2.0.0-m1 -...

Arbitrary File Download

Apache Tapestry is vulnerable to arbitrary file download. The vulnerability is due to insufficient validation of URL paths, where specially crafted URLs can reference classpath resources and allow attackers to download classpath assets...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources. Mitigation Mitigation for this issue is either not available...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899

A vulnerability exists in the tapestry-core component of Apache Tapestry (version 5.5.0+ on all platforms). An attacker can exploit Incorrect Authorization by manipulating URLs to download sensitive classpath assets , which may lead to unauthorized access to internal application resources. Users ...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

Apache Tapestry - AppModule.class Disclosure Detection (CVE-2021-27850)

Detects CVE-2021-27850 by requesting /assets/app/something/services/AppModule.class/, following the redirect, and checking for application/java content containing InnerClasses. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tapestry AppModule.class asset disclosure CVE-2021-27850.""" from...

CVE-2026-61899: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

PT-2026-69435

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions 5.5.0 through 5.9.0 Description A flaw in the tapestry-core component allows remote attackers to download classpath assets by using specially crafted URLs. Recommendations Upgrade to version 5.9.1...

Apache Tapestry Framework detect

Detects Apache Tapestry Framework detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache Tapestry Framework detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Tapestry Framework detect',...