CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

APACHE-PATH-TRAVERSAL-RCE-CVE-2021-41773-

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal / RCE Educational research project. All testing was performed in an isolated Docker lab. Do not use against any system you do not own. Vulnerability Summary Field| Detail ---|--- CVE ID| CVE-2021-41773 Affected Software| Apache HTTP Server...

Exploit for Deserialization of Untrusted Data in Apache Activemq

ActiveMQ OpenWire Deserialization RCE CVE-2023-46604 Vulhu...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

Tomcat PUT Arbitrary File Write CVE-2017-12615 Vulhubhtt...

Exploit for CVE-2020-1938

Apache Tomcat AJP Ghostcat CVE-2020-1938 Vulhubhttps://v...

Exploit for Server-Side Request Forgery in Apache Ofbiz

Apache OFBiz Authentication Bypass to RCE CVE-2023-51467 V...

CVE-2025-27636-RCE-in-Apache-Camel

CVE-2025-27636 – Apache Camel RCE Simple Python exploit for the Apache Camel header injection RCE CVE-2025-27636. Usage One-shot command execution ┌──root㉿user-/run/…/user/2024/HTBox/CVE-2025-27636 └─ python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id" Executing: id uid=0root gid=0root...

log4j-4255

log4j2 4255 — FilteredObjectInputStream allowlist bypass via java.rmi.MarshalledObject A self-contained, containerised lab that reproduces Apache log4j2 issue4255 end-to-end against the official Log4j 2.26.1 artifacts on JDK 17 , with positive controls, a hardened oracle, and a validated...

CVE-2026-23918-Apache-H2-PoC

CVE-2026-23918-Apache-H2-PoC This is a proof-of-concept exploit for the double-free vulnerability in Apache's modhttp2 CVE-2026-23918. It's a nasty bug that hits the h2mplx.c stream cleanup path. Basically, if you time it right, you can get the server to try and clean up the same stream twice,...

Apache-CVE-2026-23918-fix

Apache HTTP Server: http2: Double Free and possible RCE on early reset CVE-2026-23918. Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issu...

CVE-2026-23918-Elite-Auditor

☣️ CVE-2026-23918-Elite-Auditor ☣️ Professional Intelligence & Reconnaissance Tool for Apache HTTP/2 Double-Free Vulnerability. 📌 Overview CVE-2026-23918 CVSS 8.8 is a critical memory corruption flaw in Apache HTTP Server 2.4.66. This auditor is designed to safely fingerprint targets and assess...

CVE-2026-34197-Lab

CVE-2026-34197 — Apache ActiveMQ Classic Jolokia RCE Lab Overview This repository is a local Docker lab for studying CVE-2026-34197 , an Apache ActiveMQ Classic remote code execution issue reachable through the Jolokia JMX-HTTP API. The lab compares two ActiveMQ Classic instances side by side:...

CVE-2026-41044

CVE-2026-41044 Note: Educational Purposes Only From Advisory to RCA in an Afternoon: How AI Collapses N-Day Analysis A short, honest walkthrough of CVE-2026-41044 in Apache ActiveMQ using the exact pre and post patch code. CVE-2026-41044 was disclosed on April 24, 2026. It's a remote code executi...

CVE-2026-23918

This is a proactive tool for security auditing. For your GitHub repository, you’ll want a description that highlights its safety non-intrusive and its specific utility for system administrators. Here are a few options for your GitHub description and a template for your README.md. GitHub Repositor...

CVE-2026-42779

CVE-2026-42779 — Apache MINA Deserialization Filter Bypass to RCE CVSS 3.1: 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-502 Deserialization of Untrusted Data Reporter: Venkatraman Kumar, Securin Advisory: Apache Mailing List Overview Apache MINA versions 2.1.0 through 2.1.11 and 2.2...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

CVE-2026-23918-Apache-HTTP-Server-DoubleFree-PoC

Watch for the double-free in real-time sudo tail -f /usr/local/apache2-vuln/logs/errorlog | grep -i "double free|exit signal" Run the PoC python3 /cve-2026-23918-poc.py localhost 9443...

CVE-2026-23918-test

CVE-2026-23918-test This repository contains a Proof of Concept PoC demonstrating the Double Free vulnerability CVE-2026-23918 in Apache HTTP Server 2.4.66 modhttp2. The vulnerability stems from a race condition during early RSTSTREAM frame processing. I focused on the timing window where the...

CVE-2026-42778-POC

CVE-2026-42778 Overview Incomplete fix in Apache MINA AbstractIoBuffer.getObject method. The classname allowlist validation that restricts which classes can be deserialized is applied too late, after static initializers in classes being read may have already executed. This occurs because the...

CVE-2021-41773

CVE-2021-41773 Docker $ sudo docker build -t . $ sudo docker run -d -t -p 80:80 --name /bin/bash $ sudo docker exec -it ./bin/apachectl -k restart To access docker container for custom config file $ docker exec -it /bin/bash file config in /usr/local/apache2/conf/httpd.conf after config run comma...