Exploit for CVE-2025-6384

CrafterCMS Groovy RCE -...

CVE-2025-60113: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through = 1.4.3...

WordPress plugin Groovy Menu has a cross-site request forgeing vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

PT-2025-39560

Name of the Vulnerable Software and Affected Versions grooni Groovy Menu versions through 1.4.3 Description A Cross-Site Request Forgery CSRF issue exists in grooni Groovy Menu. This allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations Upda...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2025-59474 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2025-59475 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)

Exploit Title: XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution RCE Date: 09/01/2025 Exploit Author: Maksim Rogov Vendor Homepage: https://www.xwiki.org/ Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: 5.3‑milestone‑2 ≤ v 'Remote Code Execution...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...

ysoserial

This is a Java-based proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, named ysoserial, is designed to create gadgets that can be used to execute arbitrary commands on a vulnerable application. The gadgets are created by wrapping a...

RCE-Foryou

RCE-Foryou Python tool for safely testing and exploiting RCE v...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

CVE-2025-3586

CVE-2025-3586 affects Liferay Portal 7.4.3.27–7.4.3.42 and Liferay DXP 2024.Q1.1–2024.Q1.20, 2023.Q4.0–2023.Q4.10, 2023.Q3.1–2023.Q3.10, with the Objects module allowing remote authenticated Admin Users (Instance Administrator) to execute arbitrary Groovy scripts via Object actions, yielding remo...

📄 XWiki Platform Remote Code Execution

This Metasploit module exploits a template injection vulnerability in the the XWiki Platform. XWiki includes a macro called SolrSearch defined in Main.SolrSearchMacros that enables full-text search through the embedded Solr engine. The vulnerability stems from the way this macro evaluates search...