XXEinjector

XXEinjector XXEinjector automatizza il recupero di file utilizzando metodi diretti e out of band. La scansione delle directory funziona solo nelle applicazioni Java. Il metodo di brute-forcing deve essere utilizzato per altre applicazioni. Opzioni: --host Obbligatorio - il nostro indirizzo IP per...

xxexploiter

XXExploiter यह XML पेलोड उत्पन्न करता है, और आवश्यक DTD की सेवा या डेटा एक्सफिल्ट्रेशन के लिए स्वचालित रूप से एक सर्वर शुरू करता है। स्थापना install node and npm if you don't have it yet npm install -g xxexploiter स्रोत से निर्माण और चलाना यह एक साधारण Node एप्लिकेशन है जो TypeScript में लिखा गया...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

Apache OFBiz - XML External Entity Injection

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

VMWare Cloud Foundation NSX-V - XML External Entity (XXE)

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...

CVE-2023-45612-PoC

CVE-2023-45612 PoC Dieses Repository enthält einen Proof of Concept PoC für CVE-2023-45612, der XXE in der Standardkonfiguration von ContentNegotiation in Ktor ermöglichte. Der PoC ist in zwei Teile unterteilt: server/, enthält ein Beispiel eines Ktor-Servers, der eine betroffene Version von Ktor...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

CVE-2024-34102

CVE-2024-34102 ★ Dank an @th3gokul, Sanjaith3hacker, Chocapikk für die ursprüngliche Codebasis. ★ Beschreibung CVE-2024-34102 : Adobe Commerce XXE-Schwachstelle Beschreibung: Adobe Commerce Versionen 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 und früher sind von einer Schwachstelle aufgrund unzureichend...

Web-Security-Learning

Web-Security-Learning Projektadresse: https://github.com/CHYbeta/Web-Security-Learning Wissensplanet【Angriff und Verteidigung von Schwachstellen】: https://t.zsxq.com/mm2zBeq Inhaltsverzeichnis: Web-Security-Learning Web Security SQL-Injection MySql MSSQL PostgreSQL MongoDB Tricks Werkzeuge XSS CS...

fusionauth-samlv2

fusionauth-samlv2 Dieses Repository enthält SAML-v2.0-Bindings in Java mit JAXB. Sie können diese Bibliothek verwenden, um SAML-Anfragen und -Antworten zu verarbeiten. Beispielcode finden Sie in den Tests. Sicherheitsmeldungen Wenn Sie eine Schwachstelle oder einen anderen sicherheitsrelevanten...

CVE-2019-2888

CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE-Schwachstelle https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Beschreibung der CVE In JetBrains Ktor vor Version 2.3.5 war die Standardkonfiguration von ContentNegotiation mit XML-Format anfällig für XXE. Die Schwachstelle wurde von @marychatte am 29. September 2023 behoben...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2775 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...