272 matches found
CVE-2026-16723
A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...
FastjsonVulns
Questo repository non contiene un README...
0day
û© Reference https://xianzhi.aliyun.com/forum/topic/1926 Ա˻Ա ûԱûðȫ ÷ʽ step1: URL + /member/resetpassword.php?dopost=safequestion&safequestion=0.0&safeanswer=&id=1id step2: Դеת URL + member/resetpassword.php?dopost=getpasswd&id=9&key=dqg3OSQo 뼴...
Fastjson Insecure Deserialization - Remote Code Execution
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...
CVE-2026-16723
CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ अवलोकन CVE-2026-16723 Fastjson 1.x 1.2.68 – 1.2.83 में एक रिमोट कोड एक्ज़ीक्यूशन RCE भेद्यता है। जब Fastjson हमलावर-नियंत्रित JSON पार्स करता है, तो एक क्राफ्टेड @type मान checkAutoType के अंदर क्लास-संसाधन लुकअप में बदल जा...
CVE-2026-16723
CVE-2026-16723 Exploit Eine eigenständige C++17-Implementierung für CVE-2026-16723 , eine kritische Sicherheitslücke, die Fastjson -Versionen 1.2.68 – 1.2.83 betrifft. Anforderungen Linux oder WSL unter Windows C++17-kompatibler Compiler GCC 7+ oder Clang 5+ CMake 3.10 oder neuer Systempakete:...
CVE-2026-16723
🚨 CVE-2026-16723 — RCE über die @JSONType-Ressourcen-Erkennungskette in fastjson 1.2.83 Reproduktionsprojekt für Remote-Klassenladen / Befehlsausführung RCE bei fastjson 1.2.66 1.2.83 über@JSONType-Annotation + ungültigen Klassennamen + jar:-Protokoll. ⚠️ Haftungsausschluss Dieses Projekt dient...
Alibaba Fastjson 1.2.68 < 1.2.84 RCE (CVE-2026-16723)
The version of Alibaba Fastjson installed on the remote host is 1.2.68 through 1.2.83. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stoc...
Remote Code Execution
fastjson is vulnerable to remote code execution RCE. The vulnerability is due to insecure deserialization in Fastjson, where specially crafted input can trigger arbitrary code execution under the default configuration without requiring AutoType to be enabled or any classpath gadget...
The vulnerability of the AutoType mechanism in the Java Fastjson programming language library allows a perpetrator to execute arbitrary code.
The vulnerability of the AutoType mechanism in the Java Fastjson programming language library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-1672...
Deserialization of Untrusted Data
Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...
GHSA-CRF3-V9RR-V7HJ fastjson has a remote code execution (RCE) vulnerability
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
EUVD-2026-47929
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723
CVE-2026-16723 is a remote-code-execution vulnerability in Fastjson 1.2.68–1.2.83 that is exploitable under stock/default configuration without AutoType or a gadget. Connected docs confirm the attack chain can occur in Spring Boot fat‑JAR deployments: an attacker controls the @type value, Fastjso...
VulnCheck KEV: CVE-2026-16723
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
