CVE-2021-30128-EXP

CVE-2021-30128 Apache OFBiz Deserialisierungsschwachstelle EXP Siehe https://mp.weixin.qq.com/s/Dr-jwiRr4NByjErjiXe1w...

cve-2020-8165-demo

CVE-2020-8165 Demo Yet another demo of CVE-2020-8165, though in a more realistic implementation than most. Contesto CVE-2020-8165 Esiste una vulnerabilità di deserializzazione di dati non attendibili in rails 5.2.4.3, rails 6.0.3.1 che può consentire a un attaccante di fare unmarshal di oggetti...

CVE-2024-22369

CVE-2024-22369 Danksagungen Dieser PoC basiert auf dem Reproducer, der von Ziyang Chen vom HuaWei Open Source Management Center erstellt wurde. Der Reproducer wurde verwendet, um diesen PoC zu erstellen, mit einigen Anpassungen und Bereinigungen, und wurde auch mit etwas mehr Automatisierung...

CVE-2026-27172

Riproduttore della vulnerabilità di deserializzazione di camel-consul ConsulRegistry CVE-2026-27172 Questo progetto dimostra una vulnerabilità di deserializzazione Java nel componente camel-consul di Apache Camel ConsulRegistry, tracciata come CVE-2026-27172. Appartiene alla stessa classe di...

CVE-2025-53770

CVE-2025-53770 SharePoint Descrizione La deserializzazione di dati non attendibili in Microsoft SharePoint Server locale consente a un utente malintenzionato di eseguire codice in remoto e compromettere il sistema. Microsoft è a conoscenza dello sfruttamento attivo e sta preparando un aggiornamen...

REACT-CVE-2025-55182-Lab

Laboratorio CTF React-2025: CVE-2025-55182 Panoramica Questo repository contiene un laboratorio Capture The Flag CTF progettato esclusivamente per uso didattico e ricerca sulla sicurezza. L'ambiente include una vetrina e-commerce dimostrativa vulnerabile basata su Next.js 16 "Quantum Supplies",...

CVE-2025-55182-RCE-Exploit

POC für CVE-2025-55182 – Remote-Code-Ausführung in Next.js 16.0.6 Dieses Repository enthält einen funktionierenden Proof-of-Concept POC für CVE-2025-55182 , eine kritische Deserialisierungsschwachstelle, die Next.js 16.0.6 betrifft. Der Exploit missbraucht die $@-Chunk-Deserialisierung und...

S2-055

Exploit della vulnerabilità di deserializzazione S2-055 CVE-2017-7525 Procedura di sfruttamento javac ExploitCommand.java root@kitploit: package exploit; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import...

Lab-for-cve-2018-15133

Riepilogo: MExploiting CVE-2018-15133 Vulnerabilità di deserializzazione Questo exploit sfrutta una vulnerabilità di deserializzazione nel framework Laravel fino alla versione 5.5.40 e nelle versioni 5.6.x fino alla 5.6.29. Descrizione L'esecuzione di codice remoto potrebbe verificarsi a seguito ...

CVE-2023-46604-ActiveMQ-RCE-pseudoshell

CVE-2023-46604 RCE स्यूडोशेल यह स्क्रिप्ट CVE-2023046604 Apache ActiveMQ का उपयोग करके एक स्यूडो शेल उत्पन्न करता है। यह कमजोरी OpenWire प्रोटोकॉल में असुरक्षित डिसीरियलाइज़ेशन के कारण रिमोट कोड निष्पादन की अनुमति देती है। विवरण CVE-2023-46604 एक डिसीरियलाइज़ेशन कमजोरी है जो Apache ActiveMQ के...

freddy

Freddy the Serialisation Killer - Rilevatore di Bug di Deserializzazione Un'estensione di Burp Suite per aiutare a rilevare e sfruttare librerie/API di serializzazione. Questa utile estensione è stata originariamente sviluppata da Nick Bloor @nickstadb per NCC Group ed è basata principalmente sul...

CVE-2025-53770

مشروع كشف CVE-2025-53770 مجموعة أدوات شاملة لكشف الثغرات الأمنية لتحديد الأنظمة المعرضة لثغرة CVE-2025-53770 CWE-502: إلغاء تسلسل البيانات غير الموثوقة. 🔍 نظرة عامة يوفر هذا المشروع نصوصًا برمجية للكشف جاهزة للمؤسسات لتحديد وتقييم الأنظمة التي قد تكون معرضة لثغرة CVE-2025-53770، وهي ثغرة أمنية...

Security Bulletin:IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

Summary WmServiceMock is bundled with IBM webMethods Integration Server. Remediation steps are provided below CVE-2026-12118 Vulnerability Details CVEID:CVE-2026-12118 DESCRIPTION: IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary...

CVE-2020-6364

CVE-2020-6364 Remote-Code-Ausführung in CA APM Team Center Wily Introscope. Original-Meldung Eine Deserialisierungsschwachstelle in CA APM Team Center führt zu nicht authentifizierter Remote-Code-Ausführung auf dem Server. Bei der Authentifizierung am Server wird ein Cookie zurückgegeben, das mit...

ElasticSearch - Remote Code Execution

ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine. id: CVE-2015-1427 info: name: ElasticSearch - Remote Code Execution author: pikpikcu...

Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

Spring Data Commons - Remote Code Execution

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

QVIS NVR/DVR - Remote Code Execution

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. id: CVE-2021-41419 info: name: QVIS NVR/DVR - Remote Code Execution author: me9187 severity: critical description: | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...