fastjson-cve

CVE-2026-16723 Reproduction Project Overview This project reproduces CVE-2026-16723 — a critical Remote Code Execution RCE vulnerability in fastjson 1.2.68 through 1.2.83. The vulnerability allows RCE under default configuration without requiring AutoType enablement or pre-existing classpath...

gadgetinspector

Gadget Inspector This project inspects Java libraries and classpaths for gadget chains. Gadgets chains are used to construct exploits for deserialization vulnerabilities. By automatically discovering possible gadgets chains in an application's classpath penetration testers can quickly construct...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

EnumJavaLibs

EnumJavaLibs EnumJavaLibs: Remote Java classpath enumeration via deserialization. Overview EnumJavaLibs can be used to discover which libraries are loaded i.e. available on the classpath by a remote Java application when it supports deserialization. ----------------- Serially - v1.1 by Stefan...

CVE-2022-41853

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default ...

graylog-cve-2024-24824-exploit

Exploiting Arbitrary Class Loading on the JVM This repository contains the proof-of-concept exploit presented in my talk: Exploiting Arbitrary Class Loading on the JVM Watch it here if you're interested: Youtube The exploit targets CVE-2024-24824 minor typo in the slides, an arbitrary class loadi...

PoC_CVE-2020-9484

This repository contains a proof of concept exploit for CVE-2020-9484, along with an example web server that is vulnerable to this exploit. Prerequisites for this vulnerability to be exploitable Affected tomcat versions are: Apache Tomcat 10.x 10.0.0-M5 Apache Tomcat 9.x 9.0.35 Apache Tomcat 8.x...

GadgetProbe

Descrizione Hai appena trovato un bug di deserializzazione Java, hai eseguito tutti i tuoi payload ysoserial e... non hai ottenuto nulla. E adesso? Come puoi fare debug o costruire una catena di gadget se sei completamente cieco? Ecco GadgetProbe, uno strumento che fa luce sui classpath remoti e...

Astra Linux – Vulnerability in LibreOffice

Versions of Apache OpenOffice prior to 4.1.14 may be configured to add an empty entry to the Java class path. This may allow for the execution of arbitrary Java code from the current directory...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

CVE-2026-82385

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385

Apache Roller version 6.1.5 is vulnerable to an information disclosure flaw where a weblog administrator can read files on the application classpath , including configuration files containing secrets. The root cause is that the Velocity sandbox does not confine include and parse directives, allow...

CVE-2026-82385 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

EUVD-2026-88131

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...