CVE-2022-46364-Poc

CVE-2022-46364 利用工具 Apache CXF 通过 MTOM XOP:Include 的 SSRF | CVSS 9.8 严重 漏洞 Apache CXF -s -d -t, --target - 易受攻击的 CXF SOAP 端点（必需） -s, --ssrf-url - 要窃取的内部 URL（必需） -d, --domain - 目标域名（默认：localhost） --plain-soap - 使用纯 SOAP 而非 MTOM 示例 root@kitploit: Read /etc/passwd python3 exploit.py -t...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ 本工具仅用于教育目的。严禁在受控环境之外未经授权使用。 CVE-2025-59287 是 Microsoft Windows Server Update Services WSUS 中的一个严重远程代码执行漏洞。该漏洞源于 WSUS 组件内部对数据的不安全反序列化，允许远程未认证攻击者使服务反序列化精心构造的 .NET 对象，并在 SYSTEM 账户下执行任意代码。该漏洞通常通过向 WSUS Web 端点发送特制的 SOAP 请求来利用。本仓库旨在演示此漏洞的概念验证。 环境要求 Windows 操作系统/Linux Python 3.4+ 使用方法 此...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include 本地文件包含 CVE-2022-46364 概述 本仓库包含针对 CVE-2022-46364 的概念验证 PoC 利用程序，这是 Apache CXF 中的一个本地文件包含 LFI 漏洞。 该漏洞是由于 SOAP 请求中 XOP（XML 二进制优化打包）Include 元素处理不当引起的，允许攻击者读取服务器上的任意文件。 漏洞详情 CVE ID: CVE-2022-46364 组件: Apache CXF 漏洞类型: 本地文件包含 LFI 攻击向量: 远程（某些情况下无需认证） 影响: 服务器任意文件读取 根本原因 Apache CXF...

CVE-2026-15887

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15887 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

EUVD-2026-78056

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15887

IBM WebSphere Application Server versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30 are affected by a blind server-side request forgery (SSRF) vulnerability (CWE-918) triggered when processing SOAP requests . An attacker with low privileges can exploit this over the network with low c...

CVE-2026-76649

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

Information Disclosure

Keycloak is vulnerable to Information Disclosure. The vulnerability is due to differing error responses in the SAML ECP endpoint, where specially crafted SOAP requests with varying client IDs can trigger distinct faultstring values. An unauthenticated attacker can use these responses to determine...

PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling

A flaw was found in the PHP SoapServer component. When the server is configured to maintain session persistence, an error during a SOAP request can cause the system to incorrectly manage memory. This can lead to a "use-after-free" vulnerability, where the system attempts to use memory that has...

php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability

A flaw was found in PHP's SOAP extension. This vulnerability allows a remote attacker to execute arbitrary code on the affected system. The issue stems from a use-after-free error in the object deduplication mechanism, which can be triggered by sending a specially crafted SOAP request. This allow...

CVE-2026-9794 Keycloak: keycloak: information disclosure via saml ecp endpoint

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP Security Assertion Markup Language Enhanced Client or Proxy endpoint with varying client IDs. By observing distinct faultstrings in the...

CVE-2026-9794

Keycloak contains an information-disclosure flaw (CVE-2026-9794) where a remote, unauthenticated attacker can send crafted SOAP requests to the SAML ECP endpoint and observe differing faultstrings to infer the client protocol type. This is the scoped impact reported across NVD/Red Hat CVE entries...

📄 Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution

This script is a Python-based proof of concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server's WLS-WSAT component. The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the...

CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

(Pwn2Own) HP DeskJet 2855e JobStatusEvent Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of HP DeskJet 2855e printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When handling a JobStatusEvent, the...

CVE-2026-33373

An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...