CVE-2020-1938-Tool

CVE-2020-1938-Tool First of all, thanks to hypn0s for providing AJPY, a tool for constructing AJP protocol requests a Python library. Based on this, this project implements batch detection of Ghostcat vulnerability sites. Usage Currently has two functions root@kitploit: usage: tomcat.py -h...

CVE-2022-22965

CVE-2022-22965 aka "Spring4Shell" JDK 9+ 上の Data Binding を介した Spring Framework の RCE 脆弱性 この脆弱性に関する現時点での公知情報を可能な限り集約し、そのような場合に取るべき対策を把握することを目的としています。 私のアプリケーションは脆弱ですか？ 満たすべき条件（AND）は以下の通りです： JDK 9 + Apache Tomcat を Servlet コンテナとして使用 WAR としてパッケージ化されたアプリケーション spring-webmvc または spring-webflux の依存関係...

OPENSUSE-SU-2026:11761-1 tomcat11-11.0.25-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.25-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

OPENSUSE-SU-2026:11759-1 tomcat-9.0.121-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.121-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11760-1 tomcat10-10.1.59-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.59-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21811-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21811-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

log4j-shell-poc

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java logging library that is very widely used in the likes of elasticsearch, minecraft and numerous others. In this repository there is an example vulnerable...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: root@kitploit: uv venv source...

ghostcatch

ghostcatch Apache Tomcat の AJP コネクタを無効化して CVE-2020-1938 Ghostcat を修正する Python ツール！ 現在の対応バージョン: Python 2.7 必要条件: pip install progress 使用方法: python ghostCatch.py root@kitploit: -help 使用法を表示するフラグ 例: python ghostCatch.py -help -path パスを指定するフラグ 例: python ghostCatch.py -path /myPath システム全体で server.xml...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - 重写规则绕过 发现者： gregk4sec https://github.com/gregk4sec/cve 发现日期： 2025-02-28 受影响厂商： Apache 受影响产品： Tomcat 9.0.x / 10.1.x / 11.0.x 严重性： 严重 / 高 CWE： CWE-116 状态： 审核中 / 已修复 / 公开 ✅ / 私有 摘要 在少数不太可能出现的重写规则配置中，特制请求有可能绕过部分重写规则。如果这些重写规则实际用于强制执行安全约束，则这些约束可能被绕过。 技术分析 参见：analysis.md...

CVE-2025-24813-POC

CVE-2025-24813 Proof-of-Concept Standalone This repository contains a non-destructive, standalone PoC for CVE-2025-24813, a vulnerability in Apache Tomcat 9.0.55 allowing remote file upload via partial PUT requests. This exploit demonstrates code execution by uploading and accessing a benign JSP...

tomcatfileread

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — python3 CVE-2020-1938 CNVD-2020-10487 Explotación de lectura / inclusión de archivos del protocolo AJP de Tomcat — versión convertida a python3 del POC. Autor original python2: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-l...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨 Overview CVE-2024-52318 is a crosssite scripting XSS vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages JSPs. This issue, introduced by a prior...

CVE-2025-24813-PoC-exploit

CVE-2025-24813-PoC-exploit Apache Tomcat Deserialization RCE root@kitploit: ❯ python3 exploit.py http://localhost:8080/ "id" ============================================================ CVE-2025-24813 - Apache Tomcat Partial PUT RCE ============================================================...

Security update for tomcat10

This update for tomcat10 fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

CVE-2020-1938_Ghostcat-PoC

CVE-2020-1938Ghostcat-PoC - CVE-2020-1938 Apache Tomcat AJP Ghostcatの脆弱性（CVE-2020-1938）を悪用するための強力なPythonエクスプロイトツールで、ペネトレーションテストやセキュリティ研究のための高度な機能を備えています。 🔍 概要 Ghostcatの脆弱性（CVE-2020-1938）は、攻撃者が脆弱なApache TomcatサーバーにデプロイされたWebアプリケーションから、AJP（Apache JServ...

ROOT-APP-MAVEN-CVE-2024-50379 CVE-2024-50379 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2024-50379 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43513 CVE-2026-43513 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43513 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-24880 CVE-2026-24880 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-24880 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...