CVE-2026-82384

CVE-2026-82384 — Apache Roller — unauthenticated deserialization Laboratory model of a vulnerable service + PoC. Works against a local stand and against your own device. Vulnerability Product: Apache Roller 6.1.5 Type: CWE-502 CVSS: 9.8 CRITICAL Authentication: none Insecure deserialization of...

CVE-2026-82384

CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization Python 3 PoC for CVE-2026-82384 — Apache Roller 6.1.5 unauthenticated Java deserialization on the legacy XML-RPC servlet. PoC page: https://pocbit.org/pocs/cve-2026-82384 What is Apache Roller? Apache Roller is a Java-based, multi-user...

roller-csrf

Apache Roller v6.1.2 - Cross-Site Request Forgery CSRF in Profile Update Vulnerability Details Version : v6.1.2 Date : 2025-11-09 Exploit Author : Van Lam Nguyen Facebook : https://www.facebook.com/vanlam1412 Vendor Homepage : https://roller.apache.org Software Link :...

CVE-2026-122300

Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role...

CVE-2026-123374

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...

CVE-2026-118410

Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content...

CVE-2026-118409

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on...

CVE-2026-118414

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...

CVE-2026-118411

Cross-Site Request Forgery CSRF in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions...

CVE-2026-118413

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme...

CVE-2026-118412

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID...

CVE-2026-118405

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user...

CVE-2026-118408

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog...

CVE-2026-108338

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names,...

CVE-2026-111824

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for...

CVE-2026-105154

Cross-Site Request Forgery CSRF in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a craft...

CVE-2026-105152

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rath...

CVE-2026-105153

Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...

CVE-2026-123374

Apache Roller versions 4.0 through 6.1.6 are vulnerable to a deserialization of untrusted data vulnerability. When the software sends a weblog update ping, its XML-RPC client deserializes Java object data from the target's response. An attacker who controls that response can execute arbitrary cod...

CVE-2026-123374

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...