strutt-cve-2014-0114

CVE-2014-0114 - Vulnerabilidad en Struts 1 Los parámetros en una solicitud POST o GET se manejan como propiedades que se establecen con el formulario como punto de partida. Los parámetros pueden ser una ruta a un objeto anidado. Apache Struts 1.x puede ser manipulado para invocar getClass en Form...

beanshooter

beanshooter beanshooter is a JMX enumeration and attacking tool, which helps to identify common vulnerabilities on JMX endpoints. https://user-images.githubusercontent.com/49147108/183278179-4a5566a7-5af8-4ce8-a73d-1016876a36d5.mp4 Installation beanshooter is a maven project and installation shou...

ActiveMQ-RCE

ActiveMQ RCE Versiones afectadas versión open -a calculator Abre un servidor http root@kitploit: python3 -m http.server Ejecuta el archivo Main.java cambia la dirección según sea necesario...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Versión: 6.0.17.Final - 13-06-2019 ¿Qué es? Esta es la implementación de referencia de JSR-380 - Bean Validation 2.0. Bean Validation define un modelo de metadatos y una API para la validación de JavaBeans, así como la validación de métodos. La fuente de metadatos por defecto...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic 5.19.4, and 6.0.0 – 6.2.2 Fixed in:...

CVE-2025-27636-demo

Apache Camel CVE Demonstration This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks. Docker Build Build the Docker image: root@kitploit: docker build -t camel-cve-demo . Docker Run Run the container with all necessary ports: root@kitploit: docker...

CVE-2023-46604

Resumen Técnico del Ataque: CVE-2023-46604 El script explota una vulnerabilidad de deserialización insegura en Apache ActiveMQ CVE-2023-46604 para lograr la ejecución remota de código en el servidor objetivo. Descripción del Proceso de Explotación root@kitploit: Objetivo de la Vulnerabilidad: La...

hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

Hibernate Validator Version: 6.0.18.Final - 25-10-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

ActiveMQ-cve-2026-42588-scanner-gui

ActiveMQ-cve-2026-42588-scanner-gui 【Uso de VPS con un solo clic recomendado para usuarios con VPS】 1. Introduce la IP pública del VPS y el puerto de escucha ej: 9999 2. Introduce el comando a ejecutar ej: touch /tmp/cvepwned 3. Haz clic en 【Generar comando VPS】→ Haz clic en 【Copiar comando】 4...

activemq-cve-2023-46604

Active MQ CVE-2023-46604 エクスプロイト このリポジトリは、CVE-2023-46604 を悪用する方法の例を示すガイドです。 このエクスプロイトは、リフレクションを使用してExceptionクラスをインスタンス化する際に、不正なコマンドを送信することで悪用します。そのコマンドは、有効なコマンドの代わりに、例外クラスとしてSpringクラスを送信してBeanをロードし、文字列コンストラクタパラメータとしてSpring Bean定義を含むXMLファイルをダウンロードするURLを送信します。 このSpring Beanは実際には...

CVE-2026-83072

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83072

CVE-2026-83072 is an easily exploitable vulnerability in the Search Bean [Incl. Advanced] component of Oracle Applications Framework within Oracle E-Business Suite , affecting supported versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can compromise the com...

EUVD-2026-79400

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-12354 IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

PT-2026-92596

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83072: Improper Access Control

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...