RmiTaste

RmiTaste RmiTaste allows security professionals to detect, enumerate, interact and attack RMI services by calling remote methods with gadgets from ysoserial. It also allows to call remote method with specific parameters. Disclaimer RmiTaste was written to aid security professionals in identifying...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

JEP290_RMI_Bypass

what's this? This project is for JEP290 Bypass studying Result...

CVE-2023-32571-POC

Dynamic Linq injection to RCE - CVE-2023-32571 About Dynamic Linq injection to RCE CVE-2023-32571 Recently, members of the NCC Group discovered a vulnerability in Dynamic Linq that allows attackers to call C functions through a Linq Injection, thus making it possible to obtain RCE. Even with the...

CVE-2022-41853

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default ...

TerraMaster-TOS-CVE-2020-15568

TerraMaster TOS CVE-2020-15568 Repository for CVE-2020-15568 Metasploit module Vulnerable Application Description A dynamic class method invocation vulnerability exists in file include/exportUser.php which leads to executing remote commands on TerraMaster devices with root privileges. The...

CLEANSTART-2026-ZG57925 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

CVE-2018-3245

CVE-2018-3245 Step 1 java -jar ysoserial-cve-2018-3245.jar WHY SO SERIAL? Usage: java -jar ysoserial-cve-2018-3245.jar payload 'command' Available payload types: Payload Authors Dependencies ------- ------- ------------ CVE201828931 @mbechler CVE201828932 @mbechler CVE201828933 @mbechler...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced unauthenticated arbitrary-method-invocation validation lab + PoC Reproducible A/B lab and safe PoC for CVE-2026-19478 GitLab CE/EE, CVSS 9.4, Critical. An unauthenticated attacker can invoke arbitrary 0-argument Ruby methods on GraphQL-resolved domain...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Nuclei Template Non-destructive Nuclei detection template for CVE-2026-19478 , a critical CVSS 9.4 unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API, patched by GitLab on August 17, 2026. TL;DR GitLab's GraphQL schema supports a...

CVE-2025-27636-demo

Apache Camel CVE Demonstration This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks. Docker Build Build the Docker image: docker build -t camel-cve-demo . Docker Run Run the container with all necessary ports: docker run -d --name camel-cve-demo -...

CLEANSTART-2026-BE67528 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-hive package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

EUVD-2026-111991

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

CVE-2026-112197: Tactis NoviGest Desktop App: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

PT-2026-127188

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

CVE-2026-116019

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

CVE-2026-116019 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

EUVD-2026-109277

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page...

CVE-2026-87293

A flaw was found in OpenJDK's Remote Method Invocation RMI component. An unauthenticated remote attacker can exploit this vulnerability by sending crafted data to exposed application programming interfaces APIs. Successful exploitation allows unauthorized modification, deletion, or disclosure of...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply...