CVE-2017-1000486

CVE-2017-1000486 Exploit di Remote Code Execution per PrimeFaces 5.x - EL Injection CVE-2017-1000486 Questo è fondamentalmente lo stesso exploit creato da Mogwailabs, ma modificato per funzionare in ambienti chiusi senza accesso a internet o con traffico in uscita bloccato dal firewall. Fornisce ...

CVE-2017-1000486

CVE-2017-1000486 Este é um PoC do CVE-2017-1000486 com algumas cargas úteis para contornar verificações lexicográficas de blacklist em funções padrão usadas para obter RCE getClass, exec, etc.. e para recuperar o segredo do primefaces através de Padding Oracle para ser o menos ruidoso possível na...

pwnfaces

😛 pwnfaces Exploit di EL Injection per Primefaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento in Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 EL Injection in PrimeFaces 5.X ⚡ Installazione / Per iniziare...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 oder 6.0 - Exploit für Remote Code Execution Um die Anforderungen zu installieren, führen Sie aus: root@kitploit: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Hier ist die Verwendung des...

CVE-2017-1000486

CVE-2017-1000486 Exploit Proof of Concept per l'iniezione EL in PrimeFaces 5.x CVE-2017-1000486, una vulnerabilità RCE che può essere utilizzata per ottenere Remote Code Execution su un target. Descrizione della vulnerabilità Puoi trovare un'ottima descrizione della vulnerabilità sul blog di Mind...

primefaces

Vom Tisch zum Code: Eine Reise durch die RCE-Schwachstelle in POS für Restaurants Bei dieser Gelegenheit sind wir zufällig auf eine Schwachstelle gestoßen, die in mehreren POS-Anwendungen für Restaurants XETUX vorhanden ist, einer Lösung zur Überwachung und Automatisierung von Restaurants. In...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

CVE-2026-15538

A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This...

EUVD-2026-43294

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538

CVE-2026-15538 affects PrimeFaces PrimeReact up to 10.9.8. The vulnerability is in the API function ObjectUtils.mutateFieldData, where manipulation of the argument Field enables prototype attribute modification (prototype pollution). The attack is stated as remotely exploitable. The issue notes t...

CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

PT-2026-57643

Name of the Vulnerable Software and Affected Versions primefaces primereact versions prior to 10.9.9 Description A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the Field...

CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

EUVD-2021-1068

Malware in sbrugna...

Metasploit Weekly Wrap-Up 12/13/2024

It’s raining RCEs! It's the second week of December and the weather forecast announced another storm of RCEs in Metasploit-Framework land. This weekly release includes RCEs for Moodle e-Learning platform, Primefaces, WordPress Really Simple SSL and CyberPanel along with two modules to change...

Multiple vulnerabilities in UNIVERSAL PASSPORT RX

Overview UNIVERSAL PASSPORT RX provided by Japan System Techniques Co., Ltd. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2023-42427 Dependency on vulnerable third-party component CWE-1395 Known vulnerability in Primefaces library used in the product Cross-sit...

JVN#43215077: Multiple vulnerabilities in UNIVERSAL PASSPORT RX

UNIVERSAL PASSPORT RX provided by Japan System Techniques Co., Ltd. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score 5.4 CVE-2023-42427 Dependency on vulnerable third-party component CWE-1395 Known vulnerability in...