CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Prueba de concepto y notas técnicas para CVE-2026-34197 , una vulnerabilidad de ejecución remota de código en Apache ActiveMQ Classic accesible a través del puente JMX-HTTP de Jolokia. Afectados: ActiveMQ Classic 5.19.4, y 6.0.0 –...

beanshooter

beanshooter beanshooter is a JMX enumeration and attacking tool, which helps to identify common vulnerabilities on JMX endpoints. https://user-images.githubusercontent.com/49147108/183278179-4a5566a7-5af8-4ce8-a73d-1016876a36d5.mp4 Installation beanshooter is a maven project and installation shou...

CVE-2025-27636-demo

Demostración de CVE de Apache Camel Este proyecto demuestra vulnerabilidades de seguridad en Apache Camel relacionadas con ataques de inyección de cabeceras. Compilación de Docker Compilar la imagen de Docker: root@kitploit: docker build -t camel-cve-demo . Ejecución de Docker Ejecutar el...

CVE-2023-46604

Resumen Técnico del Ataque: CVE-2023-46604 El script explota una vulnerabilidad de deserialización insegura en Apache ActiveMQ CVE-2023-46604 para lograr la ejecución remota de código en el servidor objetivo. Descripción del Proceso de Explotación root@kitploit: Objetivo de la Vulnerabilidad: La...

strutt-cve-2014-0114

CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...

hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

Hibernate Validator Versión: 6.0.18.Final - 25-10-2019 ¿Qué es? Esta es la implementación de referencia de JSR-380 - Bean Validation 2.0. Bean Validation define un modelo de metadatos y una API para JavaBean, así como la validación de métodos. La fuente de metadatos por defecto son las anotacione...

ActiveMQ-cve-2026-42588-scanner-gui

ActiveMQ-cve-2026-42588-scanner-gui 【VPS一键利用 推荐有VPS的用户】 1. 输入 VPS 公网IP 和 监听端口 如 9999 2. 输入要执行的命令 如: touch /tmp/cvepwned 3. 点击【生成VPS命令】→ 点击【复制命令】 4. SSH登录VPS，粘贴命令并回车执行 5. 看到 Serving HTTP on 0.0.0.0:9999 说明服务已启动 6. 回到工具，点击【执行利用】发送Payload 7. 查看VPS终端，如果看到 GET /evil.xml 说明利用成功！ 【DNSLog验证 最简单，无需VPS】 1...

activemq-cve-2023-46604

Exploit de Active MQ CVE-2023-46604 Este repositorio es una guía con ejemplos sobre cómo explotar la CVE-2023-46604 El exploit aprovecha el uso de la reflexión para instanciar clases de Excepción a través de un comando malicioso que, en lugar de ser un comando válido, envía como clase de excepció...

ActiveMQ-RCE

ActiveMQ RCE Versiones afectadas versión open -a calculator Abre un servidor http root@kitploit: python3 -m http.server Ejecuta el archivo Main.java cambia la dirección según sea necesario...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Versión: 6.0.17.Final - 13-06-2019 ¿Qué es? Esta es la implementación de referencia de JSR-380 - Bean Validation 2.0. Bean Validation define un modelo de metadatos y una API para la validación de JavaBeans, así como la validación de métodos. La fuente de metadatos por defecto...

CVE-2026-83072

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-79400

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83072

CVE-2026-83072 is an easily exploitable vulnerability in the Search Bean [Incl. Advanced] component of Oracle Applications Framework within Oracle E-Business Suite , affecting supported versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can compromise the com...

CVE-2026-12354 IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

PT-2026-92596

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83072: Improper Access Control

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...