5624 matches found
S2-055
S2-055 Exploit de vulnerabilidad de deserialización CVE-2017-7525 Proceso de explotación javac ExploitCommand.java root@kitploit: package exploit; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import...
freddy
Freddy, el asesino de la serialización - Buscador de errores de deserialización Una extensión de Burp Suite para ayudar a detectar y explotar librerías/API de serialización. Esta útil extensión fue desarrollada originalmente por Nick Bloor @nickstadb para NCC Group y se basa principalmente en el...
Java-Deserialization-Scanner
Java Deserialization Scanner Java Deserialization Scanner is a Burp Suite plugin aimed at detect and exploit Java deserialization vulnerabilities. It was written by Federico Dotta, Principal Security Analyst at HN Security. The plugin is made up of three different components: 1. Integration with...
CVE-2023-46604-ActiveMQ-RCE-pseudoshell
CVE-2023-46604 RCE Pseudo-Shell Este script aprovecha CVE-2023046604 Apache ActiveMQ para generar un pseudo shell. La vulnerabilidad permite la ejecución remota de código debido a una deserialización insegura dentro del protocolo OpenWire. Descripción CVE-2023-46604 es una vulnerabilidad de...
CVE-2025-55182-RCE-Exploit
POC for CVE-2025-55182 – Next.js 16.0.6 Remote Code Execution This repository contains a working proof-of-concept POC for CVE-2025-55182 , a critical deserialization vulnerability affecting Next.js 16.0.6. The exploit abuses $@ chunk deserialization and Chunk.prototype.then to gain full control...
CVE-2020-6364
CVE-2020-6364 Ejecución remota de código en CA APM Team Center Wily Introscope. Aviso original Una vulnerabilidad de deserialización en CA APM Team Center permite la ejecución remota de código sin autenticación en el servidor. Al autenticarse en el servidor, se devuelve una cookie que comienza co...
cve-2020-8165-demo
Demostración de CVE-2020-8165 Otra demostración más de CVE-2020-8165, aunque con una implementación más realista que la mayoría. Antecedentes CVE-2020-8165 Existe una vulnerabilidad de deserialización de datos no confiables en rails 5.2.4.3, rails 6.0.3.1 que puede permitir a un atacante...
QVIS NVR/DVR - Remote Code Execution
QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. id: CVE-2021-41419 info: name: QVIS NVR/DVR - Remote Code Execution author: me9187 severity: critical description: | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java...
CVE-2021-30128-EXP
CVE-2021-30128 Эксплойт для уязвимости десериализации Apache OFBiz Ссылка: https://mp.weixin.qq.com/s/Dr-jwiRr4NByjErjiXe1w...
Laminas Project laminas-http - Remote Code Execution
Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...
Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
Better Search Replace < 1.4.5 - PHP Object Injection
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...
CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit
CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...
CVE-2025-53770
CVE-2025-53770 SharePoint Descripción La deserialización de datos no confiables en Microsoft SharePoint Server local permite que un atacante ejecute código de forma remota y comprometa el sistema. Microsoft está al tanto de la explotación activa y está preparando una actualización integral...
REACT-CVE-2025-55182-Lab
Laboratorio CTF React-2025: CVE-2025-55182 Resumen Este repositorio contiene un laboratorio de Capture The Flag CTF diseñado estrictamente para fines educativos e investigación de seguridad. El entorno incluye una tienda de demostración vulnerable construida con Next.js 16 "Quantum Supplies",...
CVE-2025-54897-LAB
Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...
Lab-for-cve-2018-15133
Summary: MExploiting CVE-2018-15133 Deserialization Vulnerability This exploit takes advantage of a deserialization vulnerability in the Laravel Framework through 5.5.40 and 5.6.x through 5.6.29. Description Remote code execution might occur as a result of an unserialize call on a potentially...
Spring Data Commons - Remote Code Execution
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...
CVE-2025-53770
Proyecto de Detección CVE-2025-53770 Un kit de herramientas integral de detección de vulnerabilidades para identificar sistemas vulnerables a CVE-2025-53770 CWE-502: Deserialización de datos no confiables. 🔍 Descripción general Este proyecto proporciona scripts de detección listos para entornos...
