CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields Denial-of-Service-Exploit Dieses Skript nutzt die Schwachstelle CVE-2024-40094 in graphql-java aus, indem es einen ExecutableNormalizedFields ENF -basierten Denial-of-Service auslöst. Es erstellt eine manipulierte GraphQL-Introspection-Abfrage mit tie...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC Usa java.net.InetAddress per il rilevamento root@kitploit: POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Code für den Veracode Blog Um die Code-Ausführung zu demonstrieren, 1. Baue das Projekt mit Maven 2. Führe python3 -m http.server 8080 aus, um den HTTP-Server zu starten 3. Führe exploit.java aus. Du solltest eine HTTP-GET-Anfrage auf dem Server sehen 4. Um zu...

Quartz-1

Zum Kompilieren: % mvn install -DskipTests Hinweis: a. Das endgültige Quartz-JAR befindet sich unter quartz/target b. Falls Sie nicht über Oracle- und/oder Weblogic-Drittanbieter-Bibliotheken JARs verfügen, die für die Kompilierung erforderlich sind diese können aufgrund von Lizenzbestimmungen...

fastjson

fastjson...

CVE-2020-26258

Descrizione XStream è una libreria Java per serializzare oggetti in XML e viceversa. In XStream precedente alla versione 1.4.15, è presente una vulnerabilità di Server-Side Forgery Request che può essere attivata durante l'unmarshalling. La vulnerabilità potrebbe consentire a un attaccante remoto...

dtls-fuzzer

dtls-fuzzer è uno strumento Java che esegue il fuzzing a livello di protocollo dello stato di server DTLS. Più concretamente, supporta le seguenti funzionalità: 1. dato un alfabeto, può generare automaticamente un modello di un'implementazione locale di un server DTLS; 2. dato un test sequenza di...

CVE-2020-8840

CVE-2020-8840 Ambiente root@kitploit: jdk 8u161 windows10 1903 Procedura root@kitploit: 1.Create a java file named Exploit.java with code you wanna run in it & compile it 2.Create a http server using python or other tools at the same dir of class file 3.Create a ldap server using marshalsec: java...

CVE-2025-24813

CVE-2025-24813 Analisi e riproduzione semplice di CVE-2025-24813, con un semplice script di exploit root@kitploit: usage: CVE-2025-24813.py -h -u URL -d DATA CVE-2025-24813 optional arguments: -h, --help show this help message and exit -u URL, --url URL URL -d DATA, --data DATA base64serialdata...

CVE-2018-1297

CVE-2018-1297 EXP per CVE-2018-1297 PS: devi scaricare ysoserial da solo!!! https://github.com/Al1ex/ysoserial-0.0.6-SNAPSHOT-all/releases...

CVE-2018-3191

CVE-2018-3191 Payload-Generator Herunterladen: https://github.com/voidfyoo/CVE-2018-3191/releases Nutzung root@kitploit: java -jar weblogic-spring-jndi.jar z.B.: root@kitploit: java -jar weblogic-spring-jndi.jar rmi://192.168.1.1:1099/Exp Hinweise weblogic-spring-jndi-12.2.1.3.jar für WebLogic:...

CVE-2020-12116

CVE-2020-12116 Codice proof-of-concept per sfruttare CVE-2020-12116: lettura arbitraria di file non autenticata su ManageEngine OpManger. Riepilogo L'ultima versione di OpManager contiene una vulnerabilità di directory traversal che consente l'accesso illimitato a tutti i file nell'applicazione...

Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution

Sonatype Nexus Repository Manager before 3.15.0 is susceptible to remote code execution. id: CVE-2019-7238 info: name: Sonatype Nexus Repository Manager 3.15.0 - Remote Code Execution author: pikpikcu severity: critical description: Sonatype Nexus Repository Manager before 3.15.0 is susceptible t...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes क्लस्टरिंग में EncryptInterceptor fail-open बाईपास, जो Java डिसीरियलाइज़ेशन के माध्यम से बिना प्रमाणीकरण के RCE की ओर ले जाता है। प्रभावित संस्करण: 11.0.19+, 10.1.53+, 9.0.116+। इनमें ठीक हुआ: 11.0.21, 10.1.54, 9.0.117। इनके द्वारा खोजा और रिपोर्ट किया गया:...

CVE-2026-75327

DocSys-master V2.02.85 contains an arbitrary file upload vulnerability in the uploadMarkdownPic interface, located in src/com/DocSystem/controller/DocController.java. The lack of proper validation on uploaded files allows an attacker to place arbitrary files on the server, which can lead to remot...

CVE-2026-75328

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:...

CVE-2026-75328

DocSys-master V2.02.85 is affected by an arbitrary file read vulnerability in the downloadDocEx interface located in src/com/DocSystem/controller/DocController.java. The vulnerability is reachable over the network with no authentication required , yielding a CVSS 3.1 score of 7.5 (HIGH) with high...

CVE-2021-44228

🛡️ CVE-2021-44228: Análise do Log4Shell - A Vulnerabilidade que Revolucionou a Segurança Java Impacto Crítico CVSS 10.0 | Descoberta em 2021, esta falha no Apache Log4j permite execução remota de código RCE e afeta milhões de sistemas globalmente. Ainda hoje, é um lembrete chave para a...

Text4Shell-Scanner

Scanner für CVE-2022-42889 Text4Shell Beschreibung Dies ist ein Scanner für die Schwachstelle CVE-2022-42889 Text4Shell Verwendung Schritt 1. Laden Sie die JAR-Datei herunter JAR-Datei befindet sich unter preparedJar/text4shell-scanner.jar 2. Überprüfen Sie die Java-Version auf Ihrem System 3...

log4j-rce-test

Compilazione ./build.sh Avvia il server log4j RCE ./start-log4j-rce-server.sh Test Esegui java -cp log4j-rce-1.0-SNAPSHOT-all.jar log4j Controlla se ottieni log in hack.log dalla cartella corrente Puoi modificare questa riga String cmds = "sh", "-c", "echo 'Exploit at '" + getDateString + "...