229 matches found
CVE-2022-46364-Poc
CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...
CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC
Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...
Journyx - XML External Entities Injection (XXE)
The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...
CVE-2026-117082
An authentication bypass vulnerability in the Universal Plug and Play UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring...
CVE-2026-117082: n/a: An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6…
An authentication bypass vulnerability in the Universal Plug and Play UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring...
PT-2026-135663
An authentication bypass vulnerability in the Universal Plug and Play UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring...
CVE-2026-117082
The Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device is affected by an authentication bypass vulnerability within its Universal Plug and Play (UPnP) framework. An attacker can execute arbitrary SOAP requests via port 5555 without credentials, exposing 15 administrative, WAN, LAN, and firewall ser...
EUVD-2026-115612
An authentication bypass vulnerability in the Universal Plug and Play UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring...
CVE-2026-117082
An authentication bypass vulnerability in the Universal Plug and Play UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring...
CVE-2025-59287-WSUS-2
CVE-2025-59287 ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services WSUS. It stems from unsafe deserializatio...
Zimbra Collaboration Suite input validation error vulnerability
Zimbra Collaboration Suite ZCS versions 10.1.20 and earlier contain an input validation error vulnerability. This vulnerability stems from improper validation of the emailAddress input in the data source test functionality. It allows authenticated regular users to inject CR/LF sequences into SMTP...
Portable SDK for UPnP Devices – Resource Management Error Vulnerability
Portable SDK for UPnP Devices. Versions prior to 2.0.0 of the Portable SDK for UPnP Devices contain a resource management vulnerability. This vulnerability stems from the ixml DOM traversal function’s unlimited recursive processing of deeply nested XML. Unauthorized local network attackers can...
CVE-2026-108116
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
EUVD-2026-102080
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
CVE-2026-108116: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
CVE-2026-15887
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...
CVE-2026-15887 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...
EUVD-2026-78056
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...
CVE-2026-15887
IBM WebSphere Application Server versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30 are affected by a blind server-side request forgery (SSRF) vulnerability (CWE-918) triggered when processing SOAP requests . An attacker with low privileges can exploit this over the network with low c...
CVE-2026-15887 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...