session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

givewp-cve-2026-82222-rce-lab

CVE-2026-82222 — GiveWP Marker-Only RCE Validation Lab Security-research material for reproducing and validating CVE-2026-82222 in an isolated Docker lab. For Direct RCE Poc and url scan useCVE-2026-8222-RCE.py Verdict Status: proven in the supplied lab GiveWP 4.16.5.1 permits an initially...

wordpress-php-object-helper

wordpress-php-object-helper About You have a Known plugin with a PHP object exploit?, but you need to determine which library to use to exploit the issue and run with phpggc. This should help you out. Example Output $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

CVE-2025-49113

Python Script for CVE-2025-49113 Usage: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2018-19276

CVE-2018-19276 OpenMRS Insecure Object Deserialization RCE From https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 Insecure object deserialization allows Arbitrary Code Execution without needing to log in. IP restrictions on Webservices module do not prevent thi...

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

exploit-CVE-2025-49113

CVE-2025-49113 PoC Repository Overview of CVE-2025-49113 CVE-2025-49113 is a critical vulnerability affecting Roundcube Webmail versions prior to 1.5.10 and 1.6.11. Discovered in 2025, this flaw allows remote code execution RCE through PHP Object Deserialization in the /settings/upload.php...

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...

openSUSE 16 Security Update : guava (openSUSE-SU-2026:22143-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22143-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object...

SUSE SLES16 Security Update : guava (SUSE-SU-2026:24263-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24263-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Jav...

Security update for guava (important)

openSUSE security update: security update for guava ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22143-1 Rating: important References: bsc1284985 Cross-References: CVE-2026-102554 CVSS scores: CVE-2026-102554 SUSE : 7.5...

OPENSUSE-SU-2026:22143-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

SUSE-SU-2026:24263-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-47168

The open-source CRM application EspoCRM is vulnerable to Remote Code Execution (RCE) in versions prior to 9.3.7 . An authenticated administrator can exploit unsafe PHP object deserialization by supplying crafted serialized data within MassAction or Export parameters . Because the application fail...

CVE-2026-102554

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...