Ofbiz-RCE

📌 Apache OFBiz RCE Exploit CVE-2024-38856 이 Python 스크립트는 /webtools/control/forgotPassword/ProgramExport 엔드포인트에 대한 인증되지 않은 접근을 통해 Apache OFBiz 버전 18.12.15의 원격 코드 실행RCE 취약점을 악용합니다. 🛠️ 설명 CVE : CVE-2024-38856 유형 : 잘못된 권한 부여 → 원격 코드 실행 구성 요소 : Apache OFBiz 영향을 받는 버전 : 18.12.15 이전 악용 방법 : 유니코드\uXXXX로...

CVE-2025-24893

CVE-2025-24893용 익스플로잇 CVE-2025-24893 는 XWiki Platform 에 영향을 미치는 치명적인 인증되지 않은 원격 코드 실행RCE 취약점 입니다. 이 결함으로 인해 모든 게스트 사용자는 인증 없이 특수하게 조작된 RSS 요청을 SolrSearch 엔드포인트로 보내 임의의 Groovy 코드 를 주입하고 실행할 수 있습니다. 이는 영향을 받는 시스템의 기밀성, 무결성 및 가용성 에 직접적인 영향을 미칩니다. 요약 영향받는 버전: XWiki ≥ 5.3-milestone-2 up to ⚠️ 면책 조항: 이...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

GHSA-825G-MM5V-GGQ4 Apache Syncope allows malicious administrators to inject Groovy code

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

EUVD-2022-0603

Malicious code in bioql PyPI...

CVE-2021-45029

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

GHSA-GH38-X2WM-XMC8 Code injection in ShenYu

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2021-45029

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

PT-2022-1573

Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.0 through 2.4.1 Description The issue is related to incorrect code generation management, which can be exploited to execute arbitrary code using Groovy Code injection or SpEL injection, leading to Remote Code...

CVE-2021-45029: Improper Control of Generation of Code

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2021-21248: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...