CVE-2019-2725

CVE-2019-2725 CVE-2019-2725 CNVD-C-2019-48814, WebLogic wls9-async Command Echo 10.3.6 12.1.3 ResultBaseExec.java Used for testing defineClass. It will recover the malicious class from base64 and execute the code, mainly for convenience optional. JDK7u21.java Generates the XML in...

CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

EUVD-2026-112282

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-84725 Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-84725

When Red Hat Enterprise Application Platform (EAP) runs with the -secmgr flag, a vulnerability in the openjdk-orb component's JDKBridge allows an unauthenticated attacker to load and instantiate arbitrary classes. This occurs because the component honors attacker-supplied CDR codebase URLs during...

CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

yaml-payload

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

hka-seminar-log4shell

Seminar Paper - Log4Shell Vulnerability Demonstration CVE-2021-44228 Security Notice This repository is intended exclusively for educational and demonstration purposes as part of a security-related seminar paper. Do not use this code in production environments or against systems without explicit...

graylog-cve-2024-24824-exploit

Exploiting Arbitrary Class Loading on the JVM This repository contains the proof-of-concept exploit presented in my talk: Exploiting Arbitrary Class Loading on the JVM Watch it here if you're interested: Youtube The exploit targets CVE-2024-24824 minor typo in the slides, an arbitrary class loadi...

Weblogic-CVE-2020-2551-To-Internet

Weblogic-CVE-2020-2551-To-Internet CVE-2020-2551 POC to use on the Internet Test POC can be used for external network testing python CVE-2020-2551.py HOST IP Attempt to modify codebase for remote class loading failed python CVE-2020-TEST.py HOST IP Discussion on weblogic CVE-2020-2551 vulnerabili...

CVE-2022-41828

CVE-2022-41828 Amazon AWS Redshift JDBC Driver Remote Code Execution RCE The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. The Driver...

CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ WARNING This code executes arbitrary commands on your system. Use ONLY in virtual machines or isolated containers. Description Functional PoC for CVE-2026-0848. Demonstrates how a malicious JAR file can execute arbitrary code when loaded by NLTK...

CVE-2022-40146_Exploit_Jar

Apache Batik SSRF to RCE Jar Exploit Component link https://github.com/apache/xmlgraphics-batik Blog https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading Usage Modify the line 11 in...

CVE-2026-16723

🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType Resource Probe Chain RCE A reproduction project for remote class loading / command execution in fastjson 1.2.66 1.2.83 via the@JSONType annotation + an illegal class name + the jar: protocol. ⚠️ Disclaimer This project is intended solely for security...

CVE-2026-47858

CVE-2026-47858 — Spring Tools "live information" mode unauthenticated JMX RCE PoC 中文 README | Advisory: Spring Security | CVE Record Vulnerability : Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 start Spring Boot applications in live information mode enabled by default with JVM...

Lightstreamer Server 7.4.8 (build 3506 ENTERPRISE) — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Load

Lightstreamer Server 7.4.8 build 3506 ENTERPRISE — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Loading Yield root RCE """Lightstreamer Server 7.4.8 build 3506 ENTERPRISE — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Loading Yield root RCE""" from future impor...

CVE-2021-44228

CVE-2021-44228 I think this story is more practical cryingchristophetd/log4shell-vulnerable-app I just researched on a whim out of interest, so there may be vague parts or mistakes. Please proceed at your own risk. Create a reproduction environment. Should work on Linux environments. 1. Download...

Important: jackson-databind

Issue Overview: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throw...

CVE-2026-71253

A flaw was found in Apache Johnzon. This vulnerability allows a remote attacker to potentially execute arbitrary code by submitting a specially crafted JSON payload. Due to unsafe class loading in the ClassConverter component, the application loads and statically initializes an attacker-specified...