362 matches found
fastjson-1.2.83-poc
Fastjson 1.2.84 ，。 Why no need for Gadgets | Hi...
fastjson-jsontype-rce-lab
fastjson @JSONType remote-class-load RCE — lab, exploit & sc...
ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.5) +10 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.5.release)
org.springframework:spring-websocket MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.5 -...
Exploit for Improper Input Validation in Alibaba Fastjson
Lab 6-CVE-2017-18349 I. SYSTEM ANALYSIS Attack S...
CVE-2026-9497
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
TCC-TRANSACTION has an Improper Input Validation vulnerability
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
GHSA-4R4V-3JC5-HRG9 TCC-TRANSACTION has an Improper Input Validation vulnerability
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the Fastjson.parseObject process of the Fastjson AutoType REST API. An attacker can execute arbitrary code or manipulate application behavior by sending specially crafted input that triggers unsafe...
CVE-2026-9497
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
EUVD-2026-31730
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
CVE-2026-9497 changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
CVE-2026-9497 changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
CVE-2026-9497
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
CVE-2026-9497
The CVE concerns changmingxie tcc-transaction (up to version 2.1.0) where the Fastjson AutoType REST API’s Fastjson.parseObject deserialization is exploitable. The issue enables remote deserialization manipulation, with a network-based attack path and low- to moderate-severity indicators across C...
TCC-TRANSACTION code-related vulnerabilities
TCC-TRANSACTION is a distributed transaction solution by the individual developer of changmingxie. TCC-TRANSACTION 2.1.0 and earlier versions have a code issue vulnerability that stems from the operation of the function Fastjson.parseObject in the Fastjson AutoType REST API component, which could...
PT-2026-43116
Name of the Vulnerable Software and Affected Versions changmingxie tcc-transaction versions prior to 2.1.1 Description A remote deserialization issue exists within the Fastjson AutoType REST API component. The flaw is located in the Fastjson.parseObject function, which allows an attacker to trigg...
CVE-2026-9497: Deserialization of Untrusted Data
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...
cn.bestwu:fastjson (>=1.1-unwrap, <=1.2-unwrap), co.paralleluniverse:comsat-spring-boot (0.6.0) +300 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (4.2.3.release)
org.springframework:spring-webmvc MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.bestwu:fastjson =1.1-unwrap, =3.5, =1.2.6, =3.0.0-0, =2.5, =2.5, =2.5, =2.6 -...
CVE-2026-4860
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It...
CVE-2026-4860 648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It...