spring4shell-exploit-poc

Spring4Shell Exploit POC Exploit a Spring Application vulnerable to the Spring4Shell vulnerability. Read more about Spring4shell on our blog. Usage Requirements: Docker and docker-compose root@kitploit: $ ./exploit.sh Vulnerable Spring Application The vulnerable Spring application contains a GET...

Spring4Shell-PoC-exploit

Spring4Shell - PoC CVE - 2022 - 22965 Versions affected : Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19 and older versions Java JDK 9 Apache Tomcat versions below 10..0.20, 9.0.62, and 8.5.78 Applications that are packaged as a traditional WAR with spring-webmvc or spring-webflux...

tomcatWarDeployer

tomcatWarDeployer Herramienta de prueba de penetración para implementación automática de WAR y aprovechamiento de Apache Tomcat. ¿Qué es? Esta es una herramienta de pruebas de penetración diseñada para aprovechar las credenciales de Apache Tomcat con el fin de generar e implementar automáticament...

CVE-2022-22965

CVE-2022-22965 Spring4Shell-PoC Version Spring Framework 5.2.20 and 5.3.18 Patched version: Spring Framework 5.3.18 and 5.2.20 Spring Boot 2.6.6 and 2.5.12 Details Spring Core is the core component of Spring Framework. This is the foundation to build other components in the Spring Framework...

St2-052

S2-052 POC Testing Original title: Tomcat Deploying war Original article: http://blog.csdn.net/caiqiiqi/article/details/77861477 Download the last affected version struts-2.5.12 from the Struts2 official website: http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip Note that you on...

Spring4Shell-CVE-2022-22965

Spring4Shell: CVE-2022-22965 RCE Java Spring framework RCE vulnerability These vulnerabilities affects a component "Spring Core" — the heart of the framework Current conditions for vulnerability:- JDK 9+ A vulnerable version of the Spring Framework 5.2 | 5.2.0-19 | 5.3.0-17 Apache Tomcat as a...

CVE-2026-12986

Technical details are not publicly available in the provided documents. Monitor for updates.

Security Bulletin: Path traversal vulnerability affect IBM Business Automation Workflow - CVE-2025-41242

Summary IBM Business Automation Workflow packages a vulnerable version of spring. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can ...

EUVD-2025-25122

Malicious code in bioql PyPI...

Spring Framework MVC Applications Path Traversal Vulnerability

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

Relative Path Traversal

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Relative Path Traversal...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

TomcatScanPro README Version: EnglishREADMEEN.m...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

SUSE CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

Security Bulletin: IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework [CVE-2022-22965]

Summary IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965. To be vulnerable a product must meet all of the following criterias: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Security Bulletin: IBM Spectrum Symphony is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Spectrum Symphony is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boo...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary Rational Test Control Panel is affected but not vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boot...