primefaces

테이블에서 코드로: 레스토랑 POS RCE 취약점을 통한 여행 이번 기회에 우리는 우연히 레스토랑 POS 애플리케이션 여러 곳에 존재하는 취약점을 발견했습니다 XETUX. 이는 레스토랑 모니터링 및 자동화 솔루션입니다. 파나마에서는 여러 레스토랑에서 널리 사용되는 도구입니다. 해당 취약점은 RCE원격 코드 실행로, 공격자가 인증 없이 코드를 실행하고 대상에서 권한을 획득할 수 있습니다. 1. 열거 Xetux 애플리케이션에 존재하는 라이브러리를 발견한 후, 해당 라이브러리는 PDF 생성을 담당하는 PrimeFaces라고 불립니다...

CVE-2017-1000486

CVE-2017-1000486 PrimeFaces 5.x 向けリモートコード実行エクスプロイト - EL インジェクション CVE-2017-1000486 これは基本的に Mogwailabs が作成したエクスプロイトと同じものですが、インターネットにアクセスできない、またはファイアウォールのアウトバウンドトラフィックがブロックされているクローズド環境でも動作するように編集されています。 HTTP レスポンスヘッダーで結果を確認できるため、旧エクスプロイトでブラインド RCE を試していた場合でも、もうブラインドではありません。 使用方法 root@kitploit: pytho...

pwnfaces

😛 pwnfaces Primefaces 5.X EL インジェクションエクスプロイト 🕵️ pwnfacesとは？ 🕵️ pwnfaces は、CVE-2017-1000486（PrimeFaces 5.X の EL インジェクション）として定義された脆弱性を悪用するために作成された Golang 製ツールです。 ⚡ インストール / 使用方法 pwnfaces のインストールと使用方法の簡単なガイドです。...

CVE-2017-1000486

CVE-2017-1000486 これは、RCEを達成するために使用される標準関数（getClass、execなど）の辞書順ブラックリストチェックをバイパスし、Padding Oracleを介してPrimeFacesのシークレットを取得するために役立つペイロードを含むCVE-2017-1000486のPoCです。これにより、エクスプロイト時のノイズを可能な限り低減します。 謝辞: @pimps 、 @federicodotta 、 @AonCyberLabs の関連研究に感謝します。 説明...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21、5.3.8 或 6.0 - 远程代码执行漏洞利用 要安装所需依赖，请执行： root@kitploit: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt 以下是使用漏洞利用的方法： root@kitploit: $ python primefaces.py -h...

CVE-2017-1000486

CVE-2017-1000486 PrimeFaces 5.x ELインジェクション（CVE-2017-1000486）の概念実証エクスプロイトです。このRCE脆弱性を利用して、ターゲット上でリモートコード実行が可能です。 脆弱性の説明 脆弱性の詳細な説明は、Minded Securityブログをご覧ください。 使用方法 このエクスプロイトには、重要なパラメータを表示するヘルプ機能があります。 root@kitploit: ./primefaces.py --help PrimeFaces 5.x EL injection exploit CVE-2017-1000486 by MOGW...

CVE-2017-1000486

README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

CVE-2026-15538

A flaw was found in PrimeFaces PrimeReact. A remote attacker can exploit a weakness in the ObjectUtils.mutateFieldData function within the component API. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This...

EUVD-2026-43294

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object...

CVE-2026-15538

CVE-2026-15538 affects PrimeFaces PrimeReact up to 10.9.8. The vulnerability is in the API function ObjectUtils.mutateFieldData, where manipulation of the argument Field enables prototype attribute modification (prototype pollution). The attack is stated as remotely exploitable. The issue notes t...

PT-2026-57643

Name of the Vulnerable Software and Affected Versions primefaces primereact versions prior to 10.9.9 Description A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the Field...

CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

EUVD-2021-1068

Malware in sbrugna...

Metasploit Weekly Wrap-Up 12/13/2024

It’s raining RCEs! It's the second week of December and the weather forecast announced another storm of RCEs in Metasploit-Framework land. This weekly release includes RCEs for Moodle e-Learning platform, Primefaces, WordPress Really Simple SSL and CyberPanel along with two modules to change...

Multiple vulnerabilities in UNIVERSAL PASSPORT RX

Overview UNIVERSAL PASSPORT RX provided by Japan System Techniques Co., Ltd. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2023-42427 Dependency on vulnerable third-party component CWE-1395 Known vulnerability in Primefaces library used in the product Cross-sit...