CVE-2026-2102

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102 XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102 XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102

The wrensec-commons library contains a reflected cross-site scripting (XSS) vulnerability within the CREST framework's HTTP binding. The root cause is located in the HttpUtils.prepareResponse() method, which fails to properly sanitize the _mimeType request parameter when setting the Content-Type ...

EUVD-2026-115250

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2026-2102: Wren Security wrensec-commons: wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

PT-2026-135490

wrensec-commons contains a reflected cross-site scripting XSS vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse method used the mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with...

CVE-2022-42889-POC

CVE-2022-42889-POC A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability. Utilizes OOB Out of Band services to demonstrate dns and url prefixes. JavaDocs for commons-text interpolation commons-text JavaDocs Example interpolations script:javascript...

commons-text-goat

Commons-Text Goat This is a webapp that is intentionally vulnerable to CVE-2022-42889. It uses an embedded Jetty server and Maven to start a servlet listening at port 8080 at URL \api. This endpoint accepts a URL parameter cmd. This is embedded between $ and and passed to the StringSubstitutor...

CVE-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

CVE-2022-42889-RCE

CVE-2022-42889-PoC Proof of Concept for CVE-2022-42889 remote code execution exploit Text4Shell Vulnerability. Give a ⭐ for support ❤️ About this vulnerability CVE-2022-42889 is a new critical vulnerability similar to Spring4Shell and Log4Shell. Its a RCE Remote Code Execution vulnerability with...

text4shell-exploit

text4shell-exploit A custom Python-based proof-of-concept PoC exploit targeting Text4Shell CVE-2022-42889, a critical remote code execution vulnerability in Apache Commons Text versions Example python3 text4shell.py 127.0.0.1 192.168.1.2 4444 Make sure to set up a lsitener on your attacking...

asf__commons-text_CVE-2022-42889_1-9

Apache Commons Text Apache Commons Text is a library focused on algorithms working on strings. Documentation More information can be found on the Apache Commons Text homepage. The Javadoc can be browsed. Questions related to the usage of Apache Commons Text should be posted to the user mailing...

CVE-2022-42889

🚀 CVE-2022-42889 Text4Shell Exploit A Python exploit for CVE-2022-42889 Text4Shell, a critical remote code execution vulnerability in Apache Commons Text versions prior to 1.10.0. 📋 Table of Contents Description Vulnerability Details Affected Versions Exploit Features Requirements Usage Examples...

Apache-Commons-Text-CVE-2022-42889

Apache Commons Text CVE-2022-42889 Overview Apache Text4Shell CVE-2022-42889 The affected Apache Commons Text versions 1.5 through 1.9 and it has been patched in version 1.10. Apache Commons Text is a Java library described as "a library focused on algorithms working on strings". Usage: 1. Copy...

CVE-2019-14450

This repository does not have a README...

CVE-2020-9484

CVE-2020-9484 Reproduce Apache Tomcat Session Deserialization Code Execution Vulnerability CVE-2020-9484 with Kali 2.0 Environment: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz webapp is s2-053, added commons-collections4-4.0.jar under its lib Start /yourtomcatdir/bin/startup.sh...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

CVE-2022-33980

CVE-2022-33980 CVE Apache Commons RCE can use url,dns,script key-words to connect any server...

text4shell-exploit

Text4shell-exploit This is a Proof of Concept exploiting the vulnerability in Apache Commons Text CVE-2022-42889 Vulnerable versions : 1.5.0 to not including 1.10.0 Impact Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code on the vulnerable...