CVE-2025-31722

CVE-2025-31722 — Jenkins Templating Engine RCE For educational and authorized security research purposes only. Description Sandbox bypass vulnerability in the Jenkins Templating Engine JTE plugin = 2.5.3 that allows a low-privileged user to execute arbitrary code on the Jenkins server. The flaw...

CVE-2024-23897-Jenkins-4.441

CVE-2024-23897 - Jenkins Arbitrary File Leak Compile g++ CVE-2024-23897.cpp -o exploit Usage /exploit -u http://10.10.10.10 -f /etc/passwd...

CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability

Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. CVE-2024-23897Arbitrary File Read Vulnerability Jenkins 2.441 and earlier, LTS 2.426.2 and...

CVE-2026-22018-Jenkins-Pipeline-Shared-Library-Code-Execution-via-Grab-

CVE-2026-22018 – Jenkins Pipeline Shared Library Code Execution via @Grab Program Code Groovy pipeline // Jenkinsfile - loads untrusted shared library @Library'evil-library@master' node evilStep CVE-2026-22018 – Jenkins Pipeline Shared Library Remote Code Execution Overview A Jenkins pipeline loa...

awesome-jenkins-rce-2019

awesome-jenkins-rce-2019 There is no pre-auth RCE in Jenkins since May 2017, but this is the one! It chains CVE-2018-1000861, CVE-2019-1003005 and CVE-2019-1003029 to a more reliable and elegant pre-auth remote code execution! Affect list ANONYMOUSREAD disable Jenkins version 2.138 ANONYMOUSREAD...

awesome-jenkins-rce-2019

awesome-jenkins-rce-2019 Non c'è una RCE pre-autenticazione in Jenkins dal maggio 2017, ma questa è quella giusta! Combina CVE-2018-1000861, CVE-2019-1003005 e CVE-2019-1003029 per un'esecuzione remota di codice pre-autenticazione più affidabile ed elegante! Elenco delle versioni interessate...

CVE-2024-23897

CVE-2024-23897 Scraping tool to ennumerate directories or files with the CVE-2024-23897 vulnerability in Jenkins. Usage python3 scraping.py -u http://server:8080 -l /path/to/wordlist -o output.txt...

CVE-2024-43044

CVE-2024-43044 Description This script checks Jenkins instances for CVE-2024-43044 by retrieving the Jenkins version from the instance and comparing it against known vulnerable version ranges. CVE-2024-43044 : This vulnerability affects Jenkins core and remoting versions, allowing attackers to...

Jenkins-CVE-2024-23897-Lab

Jenkins CVE-2024-23897 Lab Arbitrary file read vulnerability in Jenkins 2.441 and earlier. Launch docker-compose up -d Automated Attack docker exec -it attacker-host ./auto-exploit.sh Manual Attack docker exec -it attacker-host bash cd /tmp curl -o jenkins-cli.jar...

CVE-2024-23897

CVE-2024-23897 - Jenkins Arbitrary File Read Exploit Tool Installation CVE-2024-23897 requires go 1.21 to complete installation. Execute the following command: go install github.com/wjlin0/CVE-2024-23897/cmd/CVE-2024-23897@latest Or download the pre-built binary from release macOS-arm64 macOS-amd...

CVE-2024-23897

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...

CVE-2024-23897

CVE-2024-23897 Jenkins RCE Arbitrary File Read CVE-2024-23897 Usage: python poc.py http://127.0.0.1:8888/ /etc/passwd Update: Update to Jenkins 2.442, LTS 2.426.3 Fix: If you can't update to the latest version, disable access to the CLI, this should completely eliminate the possibility of...

CVE-2022-44877-RCE

This repository does not have a README...

CVE-2024-23897

CVE-2024-23897 Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controll...

Jenkins-CVE-2016-9299

Jenkins-CVE-2016-9299...

CVE-2024-23897-Arbitrary-file-read

🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Affected versions: Jenkins 2.441 and earlier. Jenkins LTS 2.426.2 and earlier. A Python script to automate the vulnerability CVE-2024-23897 🤖 🛠️ This Python code presents a scanner for a specific vulnerability CVE-2024-23897 in Jenkins servers. It starts by...

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

Jenkins Pipeline: Groovy Plugin workflow-cps version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with...

CVE-2026-84654

A flaw was found in Stapler, a web framework used by Jenkins. This vulnerability allows an attacker, who can submit configuration forms, to modify public static fields of configuration objects. This modification can lead to changes that apply globally across the entire Jenkins instance, potential...

CVE-2017-1000353

CVE-2017-1000353 POC How to reproduce the Jenkins CVE-2017-1000353？ Clone this repository, use the pre-built payload jenkinspoc.ser with flowing command: python exploit.py http://your-ip:8080 jenkinspoc.ser Then the touch /tmp/success would be executed. Java Version Requirements Important : The...

CVE-2024-23897

CVE-2024-23897 Environment Setup 1. Install Java sudo apt update sudo apt install openjdk-11-jdk -y 2. Download Jenkins WAR file wget https://get.jenkins.io/war/2.441/jenkins.war 3. Change default Java version - Select Java 11 sudo update-alternatives --config java 4. Verify version - Check...