Spring4Shell-PoC-exploit

Spring4Shell - PoC CVE - 2022 - 22965 Versiones afectadas : Versiones de Spring Framework 5.3.0 a 5.3.17, 5.2.0 a 5.2.19 y versiones anteriores Java JDK 9 Versiones de Apache Tomcat inferiores a 10..0.20, 9.0.62 y 8.5.78 Las aplicaciones empaquetadas como un WAR tradicional con dependencia...

CVE-2022-22965-PoC

PoC de CVE-2022-22965 Ejemplo mínimo de cómo reproducir CVE-2022-22965 Spring RCE. Ejecutar usando docker compose 1. Construye la aplicación usando Docker compose docker-compose up --build 2. Para probar la aplicación navega a http://localhost:8080/handling-form-submission-complete/greeting 3...

java-remote-class-loader

此工具允许您以类文件的形式将 Java 字节码发送给客户端（或潜在目标），通过 Java ClassLoader 和 Reflect API 加载并执行。客户端接收来自服务器的类文件，并返回相应的执行输出。载荷必须用 Java 编写，并在启动服务器前编译完成。 功能特性 客户端-服务器架构 Java 类文件的远程加载 传输中加密（使用 ChaCha20 密码） 通过参数进行设置 保活机制：服务器重启后重新建立通信 安装 该工具已在 Windows 和 Linux（zip 便携版）上使用 OpenJDK 11 及 JRE Java 包进行了测试。 由于依赖关系，Java 版本应为 11...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

SSE4-CVE-2022-22965

Spring Boot CVE-2022-22965 PoC en Docker para CVE-2022-22965 con Spring Boot versión 2.6.5 Primeros pasos 1. Ejecuta docker compose up --build para construir e iniciar la aplicación vulnerable. 2. Ejecuta curl -H "Accept: text/html;"...

CVE-2014-0094

CVE-2014-0094 Para verificación. Basado en https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 se reproduce. El classLoader está funcionando, pero el log clave ha quedado percent-encoded, por lo que no se llega a RCE También se añadió la versi...

Spring4Shell

Spring RCE CVE-2022-22965 Vulnerability Environment Environment Information springboot jdk11 tomcat9.0.30 payload Request Header Configuration "suffix": "%//", "c1": "Runtime", "c2": "%", "DNT": "1", "Content-Type": "application/x-www-form-urlencoded", Request Body Data...

struts1-patch

struts1-patch Descripción detallada y uso, ver: http://security.tencent.com/index.php/blog/msg/50 Parche de vulnerabilidad de manipulación de classLoader de struts1 CVE-2014-0114 struts.jar...

ARTful

Descripción ARTful es una biblioteca nativa de Android que permite a los desarrolladores modificar el Android Runtime ART en Android 13 y 14. Con esta herramienta, puedes cambiar dinámicamente la implementación de cualquier método estático dentro de tu aplicación o del Android Framework para...

Spring4Shell-POC

Spring4Shell CVE-2022-22965 - Prueba de Concepto de Ejecución Remota de Código Una Prueba de Concepto PoC totalmente contenerizada que demuestra la explotación de Spring4Shell CVE-2022-22965 , lo que resulta en Ejecución Remota de Código RCE contra una aplicación Spring Framework vulnerable...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

Ejecución Remota de Código No Autenticada en PowerJob Worker a través de /worker/deployContainer Carga Arbitraria de JAR 1. Resumen El Worker de PowerJob expone el manejador deployContainer en su puerto de transporte HTTP 27777 sin autenticación alguna. Un atacante envía una URL arbitraria; el...

Missing Release of Memory after Effective Lifetime

Overview org.apache.karaf:org.apache.karaf.util is a modern and polymorphic applications container. It's a lightweight, powered, and enterprise ready container powered by OSGi Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper...

CVE-2026-92230 Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle...

EUVD-2026-78662

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

Astra Linux – Vulnerability in Commons-BeanUtils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added, which enables suppressing the ability for an attacker to access the classloader through the class property available on all Java objects. However, we did not use this feature by default, as it is a characteristic of...

Astra Linux – Vulnerability in Commons-BeanUtils

Apache Commons has a vulnerability related to improper access control. A special BeanIntrospector class was added in version 1.9.2. This can be used to prevent attackers from using the declared class property of Java enum objects to gain access to the classloader. However, this protection was not...

Path Traversal

org.xwiki.commons, xwiki-commons-classloader-api is vulnerable to Path Traversal. The vulnerability is due to improper validation of the resource parameter in the ssx and jsx endpoints, which allows an attacker to exploit leading slashes and directory traversal sequences to read arbitrary...

SUSE CVE-2025-48734

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default...

CVE-2026-9498 Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine

A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engin...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the resource parameter in the ssx and jsx endpoints when a leading slash is used. An attacker can access sensitive configuration files by crafting a URL that traverses directories. Note: This issue is due to...