CVE-2015-5254

CVE-2015-5254 ActiveMQ Deserialization RCE 0x01 sure port 61616 is open nmap -p 61616 -Pn -T5 -n -sC -sV 10.10.20.166 root@kitploit: root@kali: nmap -p 61616 -Pn -T5 -n -sC -sV 10.10.20.166 Starting Nmap 7.70 https://nmap.org at 2019-08-30 02:05 EDT Nmap scan report for 10.10.20.166 Host is up...

cve-2019-1003000-jenkins-rce-poc

PoC: Jenkins RCE SECURITY-1266 / CVE-2019-1003000 Script Security, CVE-2019-1003001 Pipeline: Groovy, CVE-2019-1003002 Pipeline: Declarative A proof of concept to allow users with Overall/Read permission and Job/Configure and optional Job/Build to bypass the sandbox protection and execute arbitra...

react2shell

React2Shell CLI tool + Nuclei templates for detecting two critical RCE vulnerabilities in React Server Components and Next.js Server Actions. The scanner was rewritten based on the disclosed react2shell vuln. Vulnerability Overview CVE-2025-55182 – React Server Components Deserialization RCE A fl...

ibm-sterling-b2b-integrator-poc

IBM Sterling B2B Integrator PoC IBM Sterling B2B Integrator, संस्करण 6.2.0.0 से 6.2.0.2, और 6.0.0.0 से 6.1.2.5 Linux, Windows और AIX सिस्टम के लिए में पाई गई कमजोरियों के शोषण के लिए प्रूफ ऑफ कॉन्सेप्ट कोड: LPE कमांड इंजेक्शन - यदि प्रमाणीकरण अक्षम है प्री-ऑथ डिसीरियलाइजेशन RCE - CVE-2024-31903...

CVE-2026-50522

🛡️ CVE-2026-50522 — Enquête sur le RCE de Microsoft SharePoint Vulnérabilité critique de désérialisation SharePoint activement exploitée Créé par Pratik Chhetri Date du rapport : 2026-07-27 📌 Synthèse exécutive...

OSWE-Labs-Poc

OSWE - Laboratoires Laboratoires dockerisés pour la certification Web Expert OSWE. Préparation pour la formation AWAE à venir ... Autre projet : analyse de malwares et chasse aux cybermenaces https://github.com/svdwi/BlueBox Laboratoires disponibles pour l'OSWE 1. ATutor est un système de gestion...

CVE-2021-2302

CVE-2021-2302 Author: quynhle Gadget chain root@kitploit: javax.management.BadAttributeValueExpException.readObject oracle.security.jps.az.internal.common.principals.toString oracle.security.jps.az.internal.common.principals.getResolvedPrincipal . . . con.newInstance...

log4j-4255

log4j2 4255 — Contournement de la liste blanche de FilteredObjectInputStream via java.rmi.MarshalledObject Un laboratoire autonome et conteneurisé qui reproduit de bout en bout le problème Apache log4j24255 contre les artefacts officiels Log4j 2.26.1 sur JDK 17 , avec des contrôles positifs, un...

CVE-2025-55182-Exploit

CVE-2025-55182 — ثغرة إلغاء التسلسل في Next.js Flight RCE أداة استغلال تنفيذ الأوامر عن بُعد لثغرة إلغاء التسلسل في إجراءات خادم Next.js Flight 📌 نظرة عامة يحتوي هذا المستودع على أداة استغلال صالحة لـ CVE-2025-55182 ، وهي ثغرة إلغاء تسلسل في بروتوكول Flight الخاص بـ Next.js إجراءات الخادم. من خلا...

CVE-2019-10068-PoC

CVE-2019-10068 PoC لنظام Kentico CMS إثبات مفهوم لاستغلال CVE-2019-10068، يستغل ثغرة إلغاء التسلسل Deserialization RCE في Kentico CMS لرفع قشرة ويب. إخلاء مسؤولية قانوني: يُقدَّم هذا الإثبات لأغراض البحث الأمني التعليمي والمصرح به فقط. المؤلف غير مسؤول عن أي إساءة استخدام أو ضرر ناتج عن هذا الكود...

Weblogic_CVE-2020-2883_POC

weblogic CVE-2020-2883 के लिए POC poc1: root@kitploit: javax.management.BadAttributeValueExpException.readObject com.tangosol.internal.sleepycat.persist.evolve.Mutations.toString java.util.concurrent.ConcurrentSkipListMap$SubMap.size java.util.concurrent.ConcurrentSkipListMap$SubMap.isBeforeEnd...

CVE-2025-24813-PoC-exploit

CVE-2025-24813-PoC-exploit Apache Tomcat Désérialisation RCE root@kitploit: ❯ python3 exploit.py http://localhost:8080/ "id" ============================================================ CVE-2025-24813 - Apache Tomcat Partial PUT RCE ============================================================...

Project-Vuln-Detection-N-Mitigation_101

Project-Vuln-Detection-N-Mitigation101 Apache ActiveMQ Deserialization RCE CVE-2023-46604 – Phase 2 Project Security Architectures & Systems Administration Author: Vaishnavu C V · Date: 17 Sep 2025 Status: ⌀ Phase 2 deliverables complete Overview This repository documents a hands‑on security desi...

CVE-2025-10035

CVE-2025-10035 — Fortra GoAnywhere MFT License Servlet Deserialization RCE Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. A perfect-10 deserialization chain in Fortra GoAnywhere MFT: a forged license response signature lets an...

CVE-2025-55182-react2shell

CVE-2025-55182: Exposed React Server Components RSC Detector This repository contains a Nuclei template for detecting React Server Components exposure associated with CVE-2025-55182. The vulnerability affects applications built with React/Next.js where the RSC negotiation layer is unintentionally...

SharePoint-CVE-2025-53770-POC

OurSharePoint - CVE-2025-53770 PoC This is a simple C tool that builds a GZipped, Base64-encoded .NET DataSet payload using a LosFormatter-encoded inner payload. It's designed to help reproduce the SharePoint deserialization RCE chain described in public research. What it does You give it a...

HTB-Reactor-Linux-Machine-Walkthrough

HTB: Reactor !CAUTION تحذير من حرق الأحداث. هذا شرح كامل يتضمن الأعلام flags. إذا كنت تريد حل الجهاز بنفسك، أغلق هذا الآن وعد عندما تتعثر. معلومات الجهاز الحقل| التفاصيل ---|--- الاسم| Reactor نظام التشغيل| Ubuntu 24.04 LTS Noble الصعوبة| Medium CVE| CVE-2025-55182 CVSS 10.0 المنافذ| 22 SSH, 3000...

CVE-2025-68664-LangGrinch-PoC

!Severityhttps://img.shields.io/badge/Severity-CRIT...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875

Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to deserialization of untrusted data in the JobParameterDeserializer. When Jackson2ExecutionContextStringSerializer is used with an untrusted job repository data source, the deserializer...