CVE-2022-41828

CVE-2022-41828 Amazon AWS Redshift JDBC Driver Remote Code Execution RCE The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. The Driver...

yaml-payload

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

CVE-2019-2725

CVE-2019-2725 CVE-2019-2725 CNVD-C-2019-48814, WebLogic wls9-async Command Echo 10.3.6 12.1.3 ResultBaseExec.java Used for testing defineClass. It will recover the malicious class from base64 and execute the code, mainly for convenience optional. JDK7u21.java Generates the XML in...

CVE-2022-40146_Exploit_Jar

Apache Batik SSRF to RCE Jar Exploit Component link https://github.com/apache/xmlgraphics-batik Blog https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading Usage Modify the line 11 in...

CVE-2021-44228

CVE-2021-44228 I think this story is more practical cryingchristophetd/log4shell-vulnerable-app I just researched on a whim out of interest, so there may be vague parts or mistakes. Please proceed at your own risk. Create a reproduction environment. Should work on Linux environments. 1. Download...

java-remote-class-loader

此工具允许您以类文件的形式将 Java 字节码发送给客户端（或潜在目标），通过 Java ClassLoader 和 Reflect API 加载并执行。客户端接收来自服务器的类文件，并返回相应的执行输出。载荷必须用 Java 编写，并在启动服务器前编译完成。 功能特性 客户端-服务器架构 Java 类文件的远程加载 传输中加密（使用 ChaCha20 密码） 通过参数进行设置 保活机制：服务器重启后重新建立通信 安装 该工具已在 Windows 和 Linux（zip 便携版）上使用 OpenJDK 11 及 JRE Java 包进行了测试。 由于依赖关系，Java 版本应为 11...

graylog-cve-2024-24824-exploit

Explotando la carga arbitraria de clases en la JVM Este repositorio contiene el exploit de prueba de concepto presentado en mi charla: Explotando la carga arbitraria de clases en la JVM Míralo aquí si te interesa: YouTube El exploit está dirigido a CVE-2024-24824 pequeño error tipográfico en las...

Weblogic-CVE-2020-2551-To-Internet

Weblogic-CVE-2020-2551-To-Internet CVE-2020-2551 POC to use on the Internet 测试POC（可用于外网测试） python CVE-2020-2551.py HOST IP 尝试修改codebase进行远程类加载（失败） python CVE-2020-TEST.py HOST IP 浅谈 weblogic CVE-2020-2551 漏洞 & 外网POC构造 （首发于安全客，原文链接） 0x00 基础概念 学习这个漏洞需要一些前置知识，比如CORBA与RMI 简单的概述一下：...

papercut-toolkit

Kit de Defensa para PaperCut CVE-2026-81578 + CVE-2026-82078 Un kit defensivo para verificar y comprender la exposición a las vulnerabilidades encadenadas de ejecución remota de código sin autenticación previa en PaperCut: CVE-2026-81578 — Autenticación faltante para función crítica CWE-306. Una...

hka-seminar-log4shell

Seminar Paper - Log4Shell Vulnerability Demonstration CVE-2021-44228 Security Notice This repository is intended exclusively for educational and demonstration purposes as part of a security-related seminar paper. Do not use this code in production environments or against systems without explicit...

CVE-2026-90553

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

CVE-2026-47858

CVE-2026-47858 — Spring Tools live information 模式未授权 JMX 远程代码执行（PoC） English README | 漏洞公告: Spring Security Advisory | CVE Record 漏洞 ：Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 以 live information 模式 （默认开启）启动 Spring Boot 应用时，会向应用注入无认证、无 TLS、绑定全部网卡 的 JMX 远程参数。相邻网络的攻击者可以无凭据连接该 JM...

CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ ADVERTENCIA Este código ejecuta comandos arbitrarios en tu sistema. Usar SOLO en máquinas virtuales o contenedores aislados. Descripción PoC funcional para CVE-2026-0848. Demuestra cómo un archivo JAR malicioso puede ejecutar código arbitrario...

CVE-2026-16723

🚨 CVE-2026-16723 — RCE por cadena de sondeo de recursos @JSONType en fastjson 1.2.83 Proyecto de reproducción de carga remota de clases / ejecución de comandos en fastjson 1.2.66 1.2.83 mediante la anotación@JSONType + nombre de clase ilegal + protocolo jar:. ⚠️ Descargo de responsabilidad Este...

CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

CVE-2026-65181

Apache Impala versions 2.7 through 4.5 are affected by an insufficient authorization flaw in Data Source tables that enables remote code execution (RCE) via external data source class loading . A client with existing privileges can upload a file to remote storage and create a table, which trigger...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

Linux Distros Unpatched Vulnerability : CVE-2026-19032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

EUVD-2026-68961

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...