weblogic_wls_rce_poc-exp

weblogicwls-wsatcomponentdeserialisationrcecve-2017-10271 poc&exp exp only works while the path is exist can works for single or multiple ==just for learn==...

Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

My-Presentation-Slides

My-Presentation-Slides Collections of Dhiyaneshwaran public presentation slides. You can find me at: Blog: https://dhiyaneshgeek.github.io Twitter: @DhiyaneshDk Hackerone: Geek Freak LinkedIn: Dhiyaneshwaran Balasubramaniam 2026 Hands-On Supply Chain Recon & Vendor Risk Mapping Recon Village @ DE...

CVE-2026-63234

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-63233

CVE-2026-63233 is a SQL injection and unsafe deserialization vulnerability in Koollab LMS. The issue affects the assessment overall answer endpoint, where an authenticated attacker can inject SQL and influence data passed to unserialize(), potentially writing a webshell to a publicly accessible l...

CVE-2026-63234: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-63233: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-63232: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

PT-2026-57356

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution RCE, potentially allowing code execution on the affected system...

GHSA-CCGF-5RWJ-J3HV TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

Summary telejson versions prior to 6.0.0 released 2022 are vulnerable to DOM-based Cross-Site Scripting XSS through unsafe deserialisation. Attacker-controlled input from the constructor-name property in parsed JSON is passed directly to new Function without sanitisation, allowing arbitrary...

TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

Summary telejson versions prior to 6.0.0 released 2022 are vulnerable to DOM-based Cross-Site Scripting XSS through unsafe deserialisation. Attacker-controlled input from the constructor-name property in parsed JSON is passed directly to new Function without sanitisation, allowing arbitrary...

PT-2026-32206

Summary telejson versions prior to 6.0.0 released 2022 are vulnerable to DOM-based Cross-Site Scripting XSS through unsafe deserialisation. Attacker-controlled input from the constructor-name property in parsed JSON is passed directly to new Function without sanitisation, allowing arbitrary...

MiracleLinux 9 : mingw-glib2-2.78.0-1.el9 (AXSA:2024-8071:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8071:01 advisory. glib: GVariant offset table entry size is not checked in isnormal CVE-2023-29499 glib: gvariantbyteswap can take a long time with some non-normal...

CVE-2025-10492 Jaspersoft Library Deserialisation Vulnerability

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...

CVE-2025-10492

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...

PT-2025-54691

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library...

Linux Distros Unpatched Vulnerability : CVE-2022-45136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying...

CVE-2025-2000

A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats 13. A python process calling Qiskit 0.18.0 through 1.4.1's "qiskit.qpy.load" function could potentially execute any arbitrary Python code embedde...