CVE-2022-41853

بحث في CVE-2022-41853: استخدام الدوال الثابتة للحصول على RCE عبر إلغاء تسلسل Java وهجوم قاعدة الترميز البعيدة أولئك الذين يستخدمون java.sql.Statement أو java.sql.PreparedStatement في hsqldb قاعدة بيانات HyperSQL لمعالجة المدخلات غير الموثوقة قد يكونون عرضة لهجوم تنفيذ التعليمات البرمجية عن بُعد...

CVE-2020-2950

Oracle-BI CVE-2020-2950 إلغاء تسلسل AMF الإصدار: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 التثبيت: https://www.sql.edu.vn/obiee/oracle-business-intelligence-12c/ المرجع: https://peterjson.medium.com/cve-2020-2950-turning-amf-deserialize-bug-to-java-deserialize-bug-2984a8542b6f استغلال - PoC amf.bin تروي...

cve-2018-14667

cve-2018-14667 POC لـ CVE-2018-14667 التحليل الأصلي و POC: https://paper.seebug.org/765/ المرجع: https://web.archive.org/web/20190501081357/https://tint0.com/when-el-injection-meets-java-deserialization/...

CVE-2021-36981

CVE-2021-36981 Verinice.Pro 1.22.1 إلغاء تسلسل جافا غير آمن لبيانات غير موثوقة، مما يؤدي إلى تنفيذ تعليمات برمجية عن بُعد باستخدام أداة C3P0 مُوثَّق رمز PoC لاستغلال ثغرة إلغاء التسلسل. انظر...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC استخدم java.net.InetAddress للكشف POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type: application/xml...

CVE-2025-24813

CVE-2025-24813 الوصف يهدف هذا المستودع إلى توفير إرشادات واضحة للنشر السريع لـ Tomcat v9.0.90 مع java 25.0.1 2025-10-21 LTS على Windows Server 2019 Standard لممارسة محاكاة التهديدات في الأمن السيبراني. يستخدم exploit.py ملف ysoserial-all.jar لإنشاء حمولة باستخدام وحدة CommonsCollections6 في...

CVE-2026-55083

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

CVE-2026-55083

The information system DHIS2 is vulnerable to remote code execution (RCE) due to unsafe Java deserialization . This vulnerability affects versions 2.42.0 to before 2.42.5.1 and 2.43.0 to before 2.43.0.1 . An attacker could exploit this flaw to execute arbitrary code on the system. Remediation is ...

CVE-2026-55083 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

CVE-2026-55083 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

EUVD-2026-91002

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

CVE-2026-55083 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

vulscan

vulscan 扫描系统：最新的poc&exp漏洞扫描，redis未授权、敏感文件、java反序列化、tomcat命令执行及各种未授权扫描等...

PT-2026-103971

Name of the Vulnerable Software and Affected Versions DHIS2 versions 2.42.0 through 2.42.5.0 DHIS2 version 2.43.0 Description Remote code execution RCE is possible due to unsafe Java deserialization, a process where untrusted data is used to reconstruct an object in memory, potentially allowing a...

CVE-2026-55083: Deserialization of Untrusted Data

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution RCE via unsafe Java deserialization. This issue has been...

Exploit for CVE-2026-82384

CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

EUVD-2026-84866

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615

The openEQUELLA software prior to version 2026.1.0 is vulnerable to authenticated remote code execution (RCE) via Java deserialization in the HTTP invoker endpoint at /invoker/*. An authenticated non-guest user can bypass the PluginAwareObjectInputStream class-name denylist by nesting a serialize...