Spring4Shell-POC

Spring4Shell CVE-2022-22965 - Remote Code Execution Proof of Concept A fully containerized Proof of Concept PoC demonstrating the exploitation of Spring4Shell CVE-2022-22965 , resulting in Remote Code Execution RCE against a vulnerable Spring Framework application deployed on Apache Tomcat. The...

ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker Unauthenticated Remote Code Execution via /worker/deployContainer Arbitrary JAR Loading 1. Summary The PowerJob Worker exposes the deployContainer handler on its HTTP transport port 27777 with no authentication whatsoever. An attacker submits an arbitrary URL; the Worker downloads...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips, custom-pod-autoscaler, veler...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, openfga-fips, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, openfga-fips, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, openfga-fips, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, openfga-fips, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: spicedb-operator, crossplane-provider-aws-organizations, longhorn-engine-fips, cloud-provider-azure, crossplane-provider-aws-globalaccelerator-fips, external-secrets-operator, openfga-fips, dex, art, clickhouse-backup, mongodb-kubernetes-operator-fips,...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

SpringPathTraversal

This repository does not have a README...

CVE-2026-34197

🚨 CVE-2026-34197 — Critical Jolokia RCE in Apache ActiveMQ Authenticated RCE via Jolokia MBeans → Remote Spring XML → JVM Code Execution 📖 Overview CVE-2026-34197 is a high-severity authenticated remote code execution vulnerability affecting Apache ActiveMQ Classic. The issue exists in the Joloki...

CVE-2022-22965

CVE-2022-22965 aka "Spring4Shell" RCE vulnerability in Spring Framework via Data Binding on JDK 9+ The goal is to centralize as much publicly known information as possible to date about the vulnerability and to know what actions to take in such a case. Is my application vulnerable? The conditions...

CVE-2022-22965-rexbb

CVE-2022-22965-rexbb Vulnerabilidad de ejecución remota de comandos en Springboot core, herramienta de explotación CVE-2022-22965, desarrollada con JavaFx, interfaz gráfica más simple y eficiente. Miércoles 28 de diciembre de 2022 - 21:44 Estos días he estado reproduciendo vulnerabilidades y de...

TPASLog4ShellPoC

TPAS Log4Shell PoC This repository contains a Proof of Concept PoC for the Log4Shell vulnerability CVE-2021-44228, developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP. It features: A React SPA frontend that simulates a generic...

CVE-2018-1270

CVE-2018-1270 - Spring Messaging SpEL Code Execution Vulnerability Yesterday, Spring disclosed an RCE vulnerability. Take a look: CVE-2018-1270: Remote Code Execution with spring-messaging Affected Versions Spring Framework 5.0 to 5.0.4 Spring Framework 4.3 to 4.3.14 This vulnerability does not...

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 Spring-Cloud-Gateway En el primer trimestre de 2022, se descubrió una vulnerabilidad interesante y crítica puntuación base de 10.0 de inyección de código en Spring Cloud Gateway que aprovecha la API Actuator para realizar una inyección SpEL, lo que puede llevar a...