CVE-2017-1000486

CVE-2017-1000486 Remote Code Execution exploit for PrimeFaces 5.x - EL Injection CVE-2017-1000486 This is basically the same exploit made by Mogwailabs, but edited to work in closed environments without access to the internet or with blocked firewall outbound traffic. It gives you results in HTTP...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit To install the requirements execute: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Here is how to use the exploit: $ python primefaces.py -h...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

pwnfaces

😛 pwnfaces Primefaces 5.X EL Injection Exploit 🕵️ What is pwnfaces? 🕵️ pwnfaces is a Golang tool created to exploit the vulnerability defined as CVE-2017-1000486 EL Injection in PrimeFaces 5.X ⚡ Installing / Getting started A quick guide of how to install and use pwnfaces. 1. go install...

CVE-2017-1000486

CVE-2017-1000486 Proof of Concept Exploit for PrimeFaces 5.x EL Injection CVE-2017-1000486, a RCE vulnerability that can be used to gain Remote Code Execution on a target. Vulnerability description You can find an excellent description of the vulnerability on the Minded Security blog. Usage The...

primefaces

From the Table to the Code: A Journey Through the RCE Vulnerability in POS for Restaurants This time we accidentally came across a vulnerability present in several POS applications for restaurants XETUX, which is a solution for restaurant monitoring and automation. In Panama, it is a widely used...

PrimeFaces 5.2 Expression Language Injection

PrimeFaces version 5.2 contains an expression language injection vulnerability in dynamic content handling. The included proof of concept encrypts and submits an expression that can execute supplied JavaScript or operating system commands. https://packetstorm.news/download/238026...

Primefaces EL Injection RCE (CVE-2017-1000486)

Exploits CVE-2017-1000486 in Primefaces 5.x: weak AES passphrase allows forging pfdrid payloads that evaluate Java EL expressions for RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Primefaces weak encryption EL injection RCE CVE-2017-1000486.""" import base64 import re from hashlib import md5...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.2, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.2, <=5.5.1) +25 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0, =4.6.2, =4.6.2, =3.15.0, =3.15.0, =3.15.0, =3.15.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 - org.apache.tomee:apache-tomee...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-76646 Sou...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-68536 Sou...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.0, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.0, <=5.5.1) +25 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.1.0-rc1, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0-rc1, =4.6.0, =4.6.0, =3.14.7, =3.14.7, =3.14.7, =3.14.7, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 -...

CVE-2017-1000486

README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

Primetek Primefaces 5.x - Remote Code Execution Detection

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Primetek Primefaces 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

JavaServer Faces Detection

Searches for JavaServer Faces content on a URL. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for JavaServer Faces content on a URL.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JavaServer Faces Detection'...

CVE-2026-15538

A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This...

EUVD-2026-43294

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...