CVE-2025-24813

Apache Tomcat Unauthenticated RCE - CVE-2025-24813 This repository provides a guide and testing environment to assess the CVE-2025-24813 vulnerability. Details Affected Versions: Apache Tomcat 11.0.0-M1 to 11.0.2 Apache Tomcat 10.1.0-M1 to 10.1.34 Apache Tomcat 9.0.0.M1 to 9.0.98 References...

CVE-2025-24813

CVE-2025-24813 - Exploit de Ejecución Remota de Código en Apache Tomcat Este es un exploit de prueba de concepto PoC para CVE-2025-24813 , una vulnerabilidad en Apache Tomcat 9.0.80–9.0.83, 10.1.0–10.1.17 que permite la ejecución remota de código RCE mediante deserialización de sesión. El exploit...

CVE-2017-12615

curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

CVE-2025-24813

CVE-2025-24813 Script de Prueba de Concepto PoC para CVE-2025-24813, vulnerabilidad en Apache Tomcat. El script ha sido modificado basándose en el enlace relacionado y adaptado a mis necesidades. Configuración del Entorno Tomcat Vulnerable Entorno basado en la imagen oficial de Tomcat 9.0.90...

Tomcat-CVE-2025-24813

Condizioni d'Uso La funzione di scrittura di DefaultServlet è abilitata: è necessario che in web.xml sia configurato inreadonly=false Supporto delle richieste PUT parziali: Tomcat supporta l'upload a blocchi per impostazione predefinita Persistenza delle sessioni su file attivata: è necessario...

cve-2019-6715

cve-2019-6715 Ein Dank an TomNomNom für 99,9 % seines Codes.... Erstellen root@kitploit: go get github.com/fatih/color go build Verwendung root@kitploit: cat list.txt | ./2019-6715 Alle verwundbaren URLs werden in text.log protokolliert. CVE 2019-6715 Beschreibung: pub/sns.php im W3 Total Cache...

CVE-2023-3722

CVE-2023-3722 POC Python per CVE-2023-3722 Avaya Aura Device Services RCE tramite caricamento file senza restrizioni. Questo script utilizza una richiesta PUT per caricare un file php con un nome file generato casualmente di otto cifre. Successivamente effettua una richiesta GET per recuperare...

CVE-2026-30051

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Bypass de proteção de diretórios via Rewrite Valve → RCE via PUT🚨🚨 Resumo A CVE-2025-55752 é uma regressão de segurança no Apache Tomcat introduzida durante a correção do bug 60013. Quando o Rewrite Valve é utilizado, o Tomcat aplica a normalização de caminho...

EUVD-2026-67106

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2026-30051

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2026-30051

CVE-2026-30051 affects the free5gc v4.1.0 open-source 5G core network implementation. The vulnerability resides in the CreateUEContextProcedure function, reachable at the API endpoint /v1/ue-contexts/{supi} . An unauthenticated remote attacker can cause a Denial of Service by sending a crafted PU...

CVE-2020-13768

🐞 CVE-2020-13768: MiniShare 1.4.1 - Overflow del buffer basato su stack Overflow del buffer basato su stack in MiniShare 1.4.1 raggiungibile tramite una singola richiesta HTTP PUT. 📑 Indice Perché esiste questo repository Perché questa vulnerabilità è interessante Contesto e software interessato...

CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT...

EUVD-2025-210670

TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under...

CVE-2025-15682

CVE-2025-15682 affects TBEA TLogger v2.1.0.0B0.0.0.0. The web server is vulnerable to an unauthenticated resource-exhaustion condition: a remote attacker can send PUT requests to the /tmp/ endpoint, causing the server to create persistent files under /opt/myapp/webserver/ with attacker-controlled...

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...