21 matches found
XWiki-Platform-RCE-CVE-2025-24893
Exploit de RCE no autenticado en XWiki Platform Descripción general Este script es una implementación renovada en Bash de un exploit que apunta a las versiones de XWiki Platform afectadas por CVE-2025-24893. Aprovecha una vulnerabilidad crítica de ejecución remota de código no autenticado que...
CVE-2025-24893
CVE-2025-24893 Exploit de Ejecución Remota de Código RCE en XWiki Un exploit en Python3 para la CVE-2025-24893 , una vulnerabilidad crítica de Ejecución Remota de Código No Autenticada RCE que afecta a la plataforma XWiki. Este script explota una falla de Inyección de Código/Expresión CWE-95 dent...
CVE-2025-24893
CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Remote Code Execution Una vulnerabilida de categoría RCE Remote Code Execution, encontrada cuando atacantes no autenticados pueden ejecutar codigo Groovy arbitrario remotamente sin la autenticación ni el accesso previo Guest User. A continuación un P...
CVE-2026-52833
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...
CVE-2026-42049
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...
CVE-2026-42049
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...
Exploit for Code Injection in Xwiki
CVE-2025-24893 Exploit de Execução Remota de Código RCE no X...
CVE-2026-46586
CVE-2026-46586 affects Apache OFBiz prior to 24.09.06 and is described as an Improper Control of Generation of Code (Code Injection) and Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection) vulnerability. The issue enables injection/execution through Groovy code in...
CVE-2019-20155
An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...
Exploit for Code Injection in Xwiki
CVE-2025-24893-PoC XWiki Unauthenticated RCE Exploit for Reve...
EUVD-2019-10710
Malware in sbrugna...
PT-2025-42765
Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0 through 3.0.13 Apache Syncope versions 4.0.0 through 4.0.1 Description Apache Syncope allows a malicious administrator to inject Groovy code that can be executed remotely by a running Apache Syncope Core instance...
PT-2024-13997 · Janitza · Gridvis
Name of the Vulnerable Software and Affected Versions: Janitza GridVis versions 9.0.66 and earlier Description: The issue allows remote authenticated administrative users to execute arbitrary Groovy code due to exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject...
PT-2023-22295 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.1 XWiki Platform versions prior to 15.0-rc-1 Description: The issue allows any user with edit rights on a page to execute...
CVE-2023-29211 org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights WikiManager.DeleteWiki can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the wiki...
PT-2022-23189 · Xwiki · Xwiki Platform Wiki Ui Main Wiki
Name of the Vulnerable Software and Affected Versions: XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5 XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3 Description: It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity...
CVE-2017-1000403
Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts...
CVE-2016-6521
Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...