265 matches found
ActiveMQ-cve-2026-42588-scanner-gui
ActiveMQ-cve-2026-42588-scanner-gui 【VPS一键利用 推荐有VPS的用户】 1. 输入 VPS 公网IP 和 监听端口 如 9999 2. 输入要执行的命令 如: touch /tmp/cvepwned 3. 点击【生成VPS命令】→ 点击【复制命令】 4. SSH登录VPS，粘贴命令并回车执行 5. 看到 Serving HTTP on 0.0.0.0:9999 说明服务已启动 6. 回到工具，点击【执行利用】发送Payload 7. 查看VPS终端，如果看到 GET /evil.xml 说明利用成功！ 【DNSLog验证 最简单，无需VPS】 1...
hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed
Hibernate Validator 版本：6.0.18.Final - 2019-10-25 这是什么？ 这是 JSR-380 - Bean Validation 2.0 的参考实现。 Bean Validation 定义了用于 JavaBean 以及方法验证的元数据模型和 API。 默认元数据来源是注解，但可以通过使用 XML 验证描述符来覆盖和扩展元数据。 文档 此版本的文档包含在发行包的 docs 目录中，或可在线访问。 发行说明 此版本的完整变更列表可在 changelog.txt 中找到。 系统要求 JDK 1.8 或更高版本。 使用 Hibernate Validator...
strutt-cve-2014-0114
CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...
beanshooter
beanshooter beanshooter is a JMX enumeration and attacking tool, which helps to identify common vulnerabilities on JMX endpoints. https://user-images.githubusercontent.com/49147108/183278179-4a5566a7-5af8-4ce8-a73d-1016876a36d5.mp4 Installation beanshooter is a maven project and installation shou...
activemq-cve-2023-46604
Active MQ CVE-2023-46604 exploit This repository is a guide with examples on how to exploit the CVE-2023-46604 The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command that instead of being a valid command, it sends as the exception...
hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final
Hibernate Validator 版本：6.0.17.Final - 13-06-2019 这是什么？ 这是 JSR-380 - Bean Validation 2.0 的参考实现。 Bean Validation 为 JavaBean 以及方法验证定义了元数据模型和 API。 默认的元数据来源是注解，并能够通过使用 XML 验证描述符来覆盖和扩展 元数据。 文档 本次发布的文档包含在发行包的 docs 目录中，也可以在线访问。 版本说明 本次发布的完整变更列表可在 changelog.txt 中找到。 系统要求 JDK 1.8 或更高版本。 使用 Hibernate...
CVE-2026-34197-PoC
CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE 针对 CVE-2026-34197 的概念验证与技术说明，该漏洞是 Apache ActiveMQ Classic 中可通过 Jolokia JMX-HTTP 桥接触发的远程代码执行漏洞。 受影响版本： ActiveMQ Classic ⚠️ 仅供授权测试/研究/CTF 使用。请勿针对你不拥有或未经明确许可的系统运行此漏洞。 1. 侦察 root@kitploit: curl -s http://$TARGET:8161/ | grep -oiE...
CVE-2025-27636-demo
Demostración de CVE de Apache Camel Este proyecto demuestra vulnerabilidades de seguridad en Apache Camel relacionadas con ataques de inyección de cabeceras. Compilación de Docker Compilar la imagen de Docker: root@kitploit: docker build -t camel-cve-demo . Ejecución de Docker Ejecutar el...
ActiveMQ-RCE
ActiveMQ RCE 受影响版本 verison open -a calculator 开启一个 http 服务 root@kitploit: python3 -m http.server 运行 Main.java 文件（根据需要修改地址）。...
CVE-2023-46604
攻击技术摘要：CVE-2023-46604 该脚本利用Apache ActiveMQ中的不安全反序列化漏洞（CVE-2023-46604），实现在目标服务器上的远程代码执行。 漏洞利用过程描述 漏洞目标： 漏洞存在于Apache ActiveMQ的OpenWire协议中。 允许对对象进行不安全反序列化，从而可在服务器上执行任意代码。 先决条件： 能够通过网络访问ActiveMQ服务器。 目标服务器可访问的一个恶意XML文件（poc.xml），通过URL提供。 攻击组件： Python脚本：自动化向ActiveMQ服务器发送恶意载荷。 XML文件（poc.xml）：包含一个Spring...
CVE-2026-59307
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
EUVD-2026-67192
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
CVE-2026-59307
Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...
Astra Linux – Vulnerability in Jackson-Databind
In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...
EUVD-2026-40847
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...
EUVD-2026-47094
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean Incl. Advanced. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
EUVD-2026-47033
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...
CVE-2026-60676
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...
PT-2026-62710
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...