exploit-CVE-2025-49113

CVE-2025-49113 PoC リポジトリ CVE-2025-49113 の概要 CVE-2025-49113 は、Roundcube Webmail バージョン 1.5.10 および 1.6.11 より前のバージョンに影響する重大な脆弱性です。2025年に発見されたこの欠陥は、/settings/upload.php エンドポイントにおける PHP オブジェクトデシリアライゼーションを通じて、リモートコード実行 RCE を可能にします。この脆弱性は、from...

CVE-2025-49113-Simulation

Roundcube RCE 实验室 CVE-2025-49113 一个动手实践的、容器化的实验室环境，用于模拟和利用 Roundcube Webmail 中一个严重的认证后 RCE 漏洞，编号为 CVE-2025-49113。 📖 关于该漏洞 本实验演示了一个针对 Roundcube 网络邮件客户端的复杂攻击链。该漏洞是一个 认证后远程代码执行 Post-Authentication RCE ，由对 PHP 会话数据的不当处理导致 PHP 对象反序列化 PHP Object Deserialization 而引发。 已认证的攻击者可以构造一个恶意的 PHP...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 通过PHP对象反序列化的后认证RCE CVE-2025-49113 🔍 技术分析 在Roundcube（版本≤1.6.10）中发现了一个严重后认证远程代码执行漏洞，由不安全的PHP对象反序列化引起。这一严重缺陷已在代码库中悄然存在超过10年 。 完整技术分析和利用详情请访问： 👉 https://fearsoff.org/research/roundcube 🐳 快速安装（通过Docker） 这将在Docker容器中安装Ubuntu 24.04、Roundcube及所有必要依赖项： root@kitploit: docker run --name...

CVE-2018-19276

CVE-2018-19276 OpenMRS 安全でないオブジェクトデシリアライゼーション RCE From https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 ログイン不要で任意のコード実行を可能にする安全でないオブジェクトデシリアライゼーションです。Webservices モジュールの IP 制限ではこの攻撃を防ぐことはできません。 OpenMRS Platform 2.1.x 2.1.4 のすべてのバージョン OpenMRS Platform 2.0.x 2.0....

OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...

CVE-2025-49113

针对 CVE-2025-49113 的 Python 脚本 用法: python exploit.py https://ubuntu.com/security/CVE-2025-49113 描述： Roundcube Webmail 在 1.5.10 之前及 1.6.x 在 1.6.11 之前版本中，允许经过身份验证的用户远程执行代码，原因是 URL 中的 from 参数未在 program/actions/settings/upload.php 中经过验证，导致 PHP 对象反序列化。...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab CVE-2025-54236 SessionReaper の実践的デモンストレーションのための Docker 環境: Magento Open Source 2.4.7 における PHP オブジェクトデシリアライゼーションから RCE に至る脆弱性。 管理された環境でのみ使用してください。明示的な許可なくシステムに対して実行しないでください。 脆弱性について CVE-2025-54236 は、Magento Open Source および Adobe Commerce のバージョン 2.4.7...

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

CVE-2026-12720

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-12583 Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, wri...

PT-2026-53944

Name of the Vulnerable Software and Affected Versions IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 Description Approximately 50 CORBA stub classes within the ogclient.jar file call the ORB.string to object function using an attacker-controlled IOR string during Java deserializatio...

CVE-2026-11815

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution...

[SECURITY] [DSA 6317-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6317-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 01, 2026 https://www.debian.org/security/faq -...

Debian dsa-6312 : php-symfony - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6312 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6312-1 [email protected] https://www.debian.org/securit...

GHSA-M7V2-7GXM-VC2V Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Description Symfony\Bridge\Monolog\Command\ServerLogCommand the server:log console command is a development-time helper that opens a TCP listener and displays log records pushed to it by the application's logging pipeline. Two unsafe defaults combine into a remotely reachable PHP...

GHSA-36M8-W8QF-G76P SGLang: Unauthenticated RCE via --enable-custom-logit-processor

SGLang's multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads will be deserialized without validation...

CVE-2026-42778

A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the AbstractIoBuffer.getObject method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in...

PT-2026-35369

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1 Description The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using...

Exploit for Deserialization of Untrusted Data in Roundcube Webmail

CVE-2025-49113 — Roundcube Post-Auth RCE via PHP Object Deseri...