Weblogic_CVE-2020-2883_POC

POC for weblogic CVE-2020-2883 poc1: javax.management.BadAttributeValueExpException.readObject com.tangosol.internal.sleepycat.persist.evolve.Mutations.toString java.util.concurrent.ConcurrentSkipListMap$SubMap.size java.util.concurrent.ConcurrentSkipListMap$SubMap.isBeforeEnd...

CVE-2025-55182-shellinteractive

CVE-2025-55182-shellinteractive Base used from: https://github.com/Emiyelbarto/CVE-2025-55182-PoC Thank you very much for the great contribution. Overview CVE-2025-55182 is a deserialization vulnerability in Next.js/React Server Components that allows unauthenticated remote attackers to execute...

JavaUnserializeExploits

JavaUnserializeExploits Python scripts and HTTP request referenced in the blog post What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability at http://foxglovesecurity.com...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2026-110685

A flaw was found in perl-cpanel-json-xs. When processing tagged values with tag decoding enabled, decoded arguments fail to be released if the deserialization method terminates unexpectedly with an error. A remote attacker can exploit this vulnerability by submitting specially crafted documents...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

CVE-2019-7214

Windows Reverse Shell Exploit PowerShell over TCP This Python script targets a vulnerable service running on a remote Windows machine. It sends a serialized .NET payload that launches a PowerShell-based reverse shell back to the attacker's machine. CVE-2019-7214 Remote Code Execution in .NET...

ysoserial

ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...

Tomcat-CVE-2025-24813

Conditions of Use DefaultServlet write function is enabled: it needs to web.xml be configured inreadonly=false Partial PUT request support: Tomcat supports block upload by default Enable file session persistence: need to context.xml configure PersistentManager and FileStore There is a...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. Affected: 11.0.19+, 10.1.53+, 9.0.116+. Fixed in: 11.0.21, 10.1.54, 9.0.117. Found and reported by Bartlomiej Dmitruk striga.ai. Writeup:...

POC-bomber

🔥 POC-bomber 🦄 POC bomber is a vulnerability detection/exploitation tool designed to quickly gain permissions on target servers by leveraging a large number of high-impact vulnerability POCs/EXPs This project collects various high-impact vulnerabilities from the internet, such as RCE · arbitrary...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

WeblogicScan

WeblogicScan Weblogic one-click vulnerability detection tool, V1.5 Software Author: TideRabbitMask Disclaimer: Pia!ｏ ‵-′ノ”ノ﹏。 This tool is for security testing only, please do not use it for illegal purposes, be good V 1.5 Feature Introduction: Provides one-click poc detection, covering almost al...

CVE-2024-4358

CVE-2024-4358 / CVE-2024-1800 Telerik Report Server deserialization and authentication bypass exploit chain for CVE-2024-4358/CVE-2024-1800 Technical Analysis A root cause analysis of the vulnerability can be found on my blog Usage python CVE-2024-4358.py --target http://192.168.253.128:83 -c...

Gopherus

Gopherus If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF Server Side Request Forgery and gaining RCE Remote Code Execution. And also it will help you to get the Reverse shell on the victim server. And for more information y...

vuln-app-CVE-2025-55182

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARNING: This application is intentionally vulnerable for educational and security research purposes only. DO NOT deploy to production or expose to the internet. Overview This is a vulnerable Next.js application that demonstrates CVE-2025-5518...

marshalsec

Java Unmarshaller Security - Turning your data into code execution If you came here for Log4Shell/CVE-2021-44228, you may want to read about the exploitation vectors and affected Java runtime versions: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Paper It's been more than two...

phpggc

PHPGGC: PHP Generic Gadget Chains PHPGGC is a library of unserialize payloads along with a tool to generate them, from command line or programmatically. When encountering an unserialize on a website you don't have the code of, or simply when trying to build an exploit, this tool allows you to...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...