CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-22730-Scanner

CVE-2026-22730 Scanner & Exploit – Spring AI MariaDB Vector Store SQL Injection A professional security assessment tool for CVE-2026-22730 – a critical SQL injection vulnerability discovered in Spring AI's MariaDB vector store. This tool allows authorised penetration testers and security...

CVE-2026-34197

CVE-2026-34197 Apache ActiveMQ Remote Code Execution via Jolokia API Overview • Details...

Log4Shell

Log4Shell This repository is for Log4j 2021 CVE-2021-44228 Vulnerability demonstration and mitigation. What is Log4Shell? The CVE-2021-44228 / Log4Shell vulnerability consists of injecting vulnerable software with a malicious payload, which will ask Log4J to obtain a value from a third-party...

log4j-polkit-poc

log4j CVE-2021-44228 + polkit CVE-2021-4034 Vulnerable instance for the log4j apache exploit and privilege escalation using polkit The vulnable spring-boot-application.jar was extracted from this docker image The malicious JNDI server was downloaded from here and referenced in this article. PoC...

CVE-2026-47858

CVE-2026-47858 — Spring Tools "live information" mode unauthenticated JMX RCE PoC 中文 README | Advisory: Spring Security | CVE Record Vulnerability : Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 start Spring Boot applications in live information mode enabled by default with JVM...

CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 Spring-Cloud-Function-SpELRCE Vulnerability Reproduction Requires Docker environment Method 1 to start the vulnerable environment git clone https://github.com/RanDengShiFu/CVE-2022-22963.git;cd CVE-2022-22963;bash Start.sh Method 2 to start the vulnerable environment...

CVE-2022-22970

Spring CVE-2022-22970 Proof of Concept This repo contains a Development Container environment and Spring application of the correct version specifically to explore this CVE. Setup Instructions Clone the repo to your machine and use Docker and your favorite IDE. OR Use GitPod online with...

Spring-CVE-2022-22947-

This repository does not have a README...

CVE-2022-22947

CVE-2022-22947 poc for CVE-2022-22947 python CVE-202222947POC.py http://targetip:port/ Refer to POCs and articles from several experts 1.https://github.com/chaosec2021/CVE-2022-22947-POC 2.https://y4er.com/post/cve-2022-22947-springcloud-gateway-spel-rce-echo-response/...

spring-core-rce

CVE-2022-22965: Spring-Core-Rce EXP Features: 1. Vulnerability detection does not write a webshell, simple string output 2. Custom webshell file name and path 3. Does not append to the same file; each detection writes to a different webshell file name 4. Supports writing Behinder webshell 5. Prox...

CVE-2022-22963

CVE-2022-22963-Reverse-Shell-Exploit This is a Python script that exploits CVE-2022-22963, a remote code execution vulnerability in Spring Cloud Function that allows attackers to execute arbitrary code on a vulnerable server. The exploit uses the vulnerable /functionRouter endpoint to execute a...

log4j2-bugmaker

Log4j2-BugMaker CVE-2021-44228 Log4Shell Vulnerability Demonstration Project This is a demonstration project for learning and researching the Log4j2 remote code execution vulnerability Log4Shell. ⚠️ Safety Warning This project is intended for security research and educational purposes only. Do not...

CVE-2022-22947

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution Exploit Usage: python3 CVE-2022-22947.py -u "http://127.0.0.1:8080" -c "whoami" Result: Malicious SpEL expression route added successfully! Route refresh successful! Attack result obtained successfully:...

sprig-mvc-demo-patch

sprig-mvc-demo-patch This demo application partially covers the vulnerability CVE-2024-38828 The vulnerability CVE-2024-38828 in Spring Framework allows a Denial of Service DoS attack by sending a large or specially crafted request to a Spring MVC controller that accepts a parameter of type byte...

SpringBreakPoC

SpringBreakPoC I needed a tool to test several different endpoints for the recently disclosed SpringBreak vulnerability CVE-2017-8046 and couldn't find one, so I threw this together. Usage \ \ / /| \ \ \ | \ /\ | /| || | | \ || /| | || /| || \ / / | | || | | | | \ | || | | / / | || | || / / | |...