CVE-2025-24893

CVE-2025-24893 Exploit d'Exécution de Code à Distance RCE dans XWiki Un exploit en Python3 pour la CVE-2025-24893 , une vulnérabilité critique d'Exécution de Code à Distance Non Authentifiée RCE affectant la plateforme XWiki. Ce script exploite une faille d'Injection de Code/Expression CWE-95 dan...

CVE-2025-24893

CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Exécution de code à distance Une vulnérabilité de catégorie RCE Remote Code Execution, découverte lorsque des attaquants non authentifiés peuvent exécuter du code Groovy arbitraire à distance sans authentification ni accès préalable utilisateur invit...

XWiki-Platform-RCE-CVE-2025-24893

Exploit RCE non authentifié sur XWiki Platform Présentation Ce script est une implémentation Bash remaniée d'un exploit ciblant les versions de XWiki Platform affectées par CVE-2025-24893. Il exploite une vulnérabilité critique d'exécution de code à distance non authentifiée qui permet à un...

CVE-2026-52833

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

EUVD-2026-44534

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

PT-2026-58853

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049: Improper Control of Generation of Code

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

Exploit for Code Injection in Xwiki

CVE-2025-24893 Exploit de Execução Remota de Código RCE no X...

CVE-2026-46586

Apache OFBiz versions prior to 24.09.06 are vulnerable to Code Injection and Eval Injection due to improper control of code generation and improper neutralization of directives in dynamically evaluated code. Specifically, the traverseContent service fails to properly validate inputs, which can al...

CVE-2019-20155

An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...

Exploit for Code Injection in Xwiki

CVE-2025-24893-PoC XWiki Unauthenticated RCE Exploit for Reve...

CVE-2025-64133: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code...

EUVD-2019-10710

Malware in sbrugna...

PT-2025-42765

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0 through 3.0.13 Apache Syncope versions 4.0.0 through 4.0.1 Description Apache Syncope allows a malicious administrator to inject Groovy code that can be executed remotely by a running Apache Syncope Core instance...

PT-2024-13997 · Janitza · Gridvis

Name of the Vulnerable Software and Affected Versions: Janitza GridVis versions 9.0.66 and earlier Description: The issue allows remote authenticated administrative users to execute arbitrary Groovy code due to exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject...

PT-2023-22295 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.1 XWiki Platform versions prior to 15.0-rc-1 Description: The issue allows any user with edit rights on a page to execute...

CVE-2023-29211 org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights WikiManager.DeleteWiki can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the wiki...