CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

CVE-2017-12615

In memory of Chia Junyuan https://packetstormsecurity.com/files/author/11924/ POC CVE-2017-12615 POC Exploit for Apache Tomcat 7.0.0 to 7.0.79 running on Windows; CVE-2017-12615 PUT JSP vulnerability. Description: By design, you are not allowed to upload JSP files via the PUT method on the Apache...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths. CVE ID: CVE-2025-24813 Severity: Critical Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg Po...

wso2-rce-cve-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading...

CVE-2022-29464

CVE-2022-29464 Introduction Critical WSO2 vulnerability CVE-2022-29464 was found by Orange Tsai. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to submit malicious JSP files to WSO2 servers and get Remote Code Execution RCE. Disclaimer: Educationa...

CVE-2016-3088

CVE-2016-3088 Statement A Python-based Exploit Script for CVE-2016-3088. This is my first script, so there may be something doesn't quite fit. But it seems go right when I tested. Discription This script can eliminate the need to capture packets during the penetration of CVE-2016-3088, so we can...

CVE-2025-34040Exp

Seeyon OA has file upload leading to RCE CVE-2025-34040 Parameters root@kitploit: options: -h, --help show this help message and exit -u URL, --url URL 请输入待检测的URL -f FILE, --file FILE 请输入一行一个URL的文件地址 -n FILENAME, --filename FILENAME 请输入文件名（默认为Hello.jsp）： -c CONTENT, --content CONTENT...

CVE-2020-1938-Exploitation

CVE-2020-1938 Exploitation Apache Tomcat arbitrary JSP upload leading to RCE Description CVE-2020-1938 is a critical vulnerability which impacts Apache Tomcat from 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 ⚠️ This was exploited in a Hack The Box lab. 🔗 Reference: NIST NVD Entry...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2018. Descripción del Exploit El exploit envía una solicitud POST que contiene una reverse shell JSP a...

tomcat-cve-2017-12617

Tomcat CVE-2017-12617 Exploit/PoC Apache Tomcat 9.0.1 Beta / 8.5.23 / 8.0.47 / 7.0.8 - JSP Upload Bypass / Remote Code Execution for Python3 I just made a few adjustments to the original script to be compatible with Python 3! If there's any problems or issues faced, feel free to shoot me an email...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...

CVE-2024-50379

CVE-2024-50379 CVE-2024-50379 Exploit CVE-2024-50379.py and upload.txt are in the same directory The upload content is the webshell Here, the upload content generates a 2.jsp file You can use 2.jsp to create a new 4.jsp, the original Behinder webshell...

CVE-2017-12615

CVE-2017-12615 - Apache Tomcat Remote Code Execution RCE CVE-2017-12615 is a Remote Code Execution RCE vulnerability affecting Apache Tomcat 7.0.0 through 7.0.79 running on Microsoft Windows when HTTP PUT requests are enabled. The vulnerability exists because Tomcat incorrectly handles uploaded J...

cve-2019-3398

cve-2019-3398 Details A quick python proof of concept for CVE-2019-3398 confluence vulnerability written in python. Confluence version 6.12.3, 6.13.3, 6.14.2, and 6.15.1 are affected. The exploit requires working credentials. To use Edit the osusername and ospassword fields, and possibly the...

CVE-2019-2618-

CVE-2019-2618 Vulnerability Detection Tool Enter the server URL, username, and password sequentially as prompted. For example: python3 CVE-2019-2618test.py http://127.0.0.1 root root123 The code will return the response body content. You can use the URL provided in the body to check whether the...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation and POC This repository contains a Proof of Concept POC for CVE-2024-50379 , a vulnerability affecting Apache Tomcat. The issue involves a Time-of-Check Time-of-Use TOCTOU race condition , which can lead to Remote Code Execution RCE , especially on case-insensitive fil...

CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability Description CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server AS Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution RCE...

CVE-2017-12615-Home-Lab

ENGLISH BELOW CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload Lab นี้จำลองช่องโหว่ CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload เกิดจากการตั้งค่า readonly=false ทำให้สามารถอัปโหลดไฟล์ผ่าน HTTP PUT ได้ รวมถึงไฟล์ .jsp ที่สามารถรันคำสั่ง RCE Features Apache Tomcat 7.0.79...

cve-2018-2894

Weblogic Arbitrary File Upload Vulnerability CVE-2018-2894 Recently, everyone has been talking about this vulnerability, and most have noticed the issue at config.do. However, according to https://mp.weixin.qq.com/s/y5JGmM-aNaHcs6P9a-gRQ the information there, begin.do also has a problem. Without...

CVE-2025-24813-POC

CVE-2025-24813 Proof-of-Concept Standalone This repository contains a non-destructive, standalone PoC for CVE-2025-24813, a vulnerability in Apache Tomcat 9.0.55 allowing remote file upload via partial PUT requests. This exploit demonstrates code execution by uploading and accessing a benign JSP...