99 matches found
CVE-2017-1000486
CVE-2017-1000486 Exploit de ejecución remota de código para PrimeFaces 5.x - Inyección de EL CVE-2017-1000486 Básicamente es el mismo exploit creado por Mogwailabs, pero modificado para funcionar en entornos cerrados sin acceso a internet o con tráfico saliente bloqueado por el firewall. Te da lo...
CVE-2017-1000486
CVE-2017-1000486 Explotación de prueba de concepto para la inyección EL de PrimeFaces 5.x CVE-2017-1000486, una vulnerabilidad RCE que puede usarse para obtener ejecución remota de código en un objetivo. Descripción de la vulnerabilidad Puede encontrar una excelente descripción de la vulnerabilid...
pwnfaces
😛 pwnfaces Exploit de inyección EL en Primefaces 5.X 🕵️ ¿Qué es pwnfaces? 🕵️ pwnfaces es una herramienta en Golang creada para explotar la vulnerabilidad definida como CVE-2017-1000486 Inyección EL en PrimeFaces 5.X ⚡ Instalación / Primeros pasos Una guía rápida de cómo instalar y usar pwnfaces. 1...
CVE-2017-1000486
CVE-2017-1000486 这是CVE-2017-1000486的一个PoC，附带一些有用的载荷，可绕过用于实现RCE的标准函数（如getClass、exec等）的黑名单字典检查，并通过Padding Oracle检索primefaces秘密，以便在利用时尽可能降低噪声。 感谢 @pimps 、 @federicodotta 和 @AonCyberLabs 在该主题上的相关工作。 描述 此PoC是一个多步骤脚本，用于分析每个应用程序和Web服务器库的上下文。 初始阶段，如果未手动提供primefaces秘密，则使用由@AonCyberLabs编写的padBuster...
CVE-2017-1000486
CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 o 6.0 - Exploit de Ejecución Remota de Código Para instalar los requisitos, ejecuta: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Así se usa el exploit: $ python primefaces.py -h...
primefaces
من الطاولة إلى الكود: رحلة عبر ثغرة RCE في نقاط البيع للمطاعم في هذه الفرصة، صادفنا بالصدفة ثغرة أمنية موجودة في العديد من تطبيقات نقاط البيع للمطاعم XETUX، وهو حل لمراقبة المطاعم وأتمتتها. في بنما، تُستخدم هذه الأداة على نطاق واسع من قبل العديد من المطاعم. الثغرة الموجودة هي RCE تنفيذ التعليمات...
CVE-2017-1000486
README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...
pwnfaces
😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...
CVE-2026-15538
A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This...
EUVD-2026-43294
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...
CVE-2026-15538
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...
CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...
CVE-2026-15538
CVE-2026-15538 affects PrimeFaces PrimeReact up to 10.9.8. The vulnerability is in the API function ObjectUtils.mutateFieldData, where manipulation of the argument Field enables prototype attribute modification (prototype pollution). The attack is stated as remotely exploitable. The issue notes t...
CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...
CVE-2026-15538
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...
CVE-2026-15538 primefaces primereact API ObjectUtils.mutateFieldData prototype pollution
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...
CVE-2026-15538: Improperly Controlled Modification of Object Prototype Attributes
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...
PT-2026-57643
Name of the Vulnerable Software and Affected Versions primefaces primereact versions prior to 10.9.9 Description A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the Field...
CVE-2020-10544
An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...