CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch

CVE-2025-24893 – XWikiにおける未認証のリモートコード実行 0 目次 1. 概要 2. 脆弱性の詳細 3. 影響を受けるバージョン 4. 概念実証 4.1 ペイロードの構築 4.2 手動による悪用 4.3 自動エクスプロイト 5. 緩和策 6. クレジットと参考文献 1 概要 CVE: 2025-24893 Component: SolrSearch マクロ XWiki UI Severity: 9.8 / 緊急 CVSS 3.1 Attack vector: 認証不要のHTTP GET Impact: 任意のGroovy実行 → システムレベルのRCE...

CVE-2024-36104-PoC

CVE-2024-36104-PoC CVE-2024-36104 の概念実証（PoC）です。これは、Apache OFBiz 18.12.14 より前 のバージョンにおける、認証不要のリモートコード実行（RCE）の脆弱性です。 OFBiz の ControlServlet は、リクエストパスを正規化する前に、認証不要のビュー（forgotPassword）を解決します。/%2e/%2e/ を追加するとパスが /webtools/control/ に折り返されるため、元のビューに紐づくセキュリティ/権限チェックを一切通過せずに ProgramExport ビューへ到達します。そして...

CVE-2026-46586 Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issu...

GHSA-2J9M-25XV-MP6R Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy...

Exploit for CVE-2026-39816

Apache NiFi CVE-2026-39816 POC Proof-of-concept demonstration...

GHSA-3JW2-5HJG-HC2C Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute sandboxed Groovy code. As of publication of this advisory, the...

CVE-2019-20155

An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...