hka-seminar-log4shell

Seminar Paper - Log4Shell Vulnerability Demonstration CVE-2021-44228 Security Notice This repository is intended exclusively for educational and demonstration purposes as part of a security-related seminar paper. Do not use this code in production environments or against systems without explicit...

The vulnerability of the `NioPathHelper.deserialize` method in the Jackson-Databind library allows a hacker to load arbitrary files.

The vulnerability of the NioPathHelper.deserialize method in the Jackson-Databind library is related to insecure dynamic class loading. Exploiting this vulnerability could allow an attacker to load arbitrary files...

The vulnerability of the printing control software in PaperCut MF and PaperCut NG, related to insecure dynamic class loading, allows a violator to execute arbitrary code.

The vulnerability of printing control software in PaperCut MF and PaperCut NG lies in the unsafe dynamic loading of classes, due to the lack of checks to ensure that the loaded classes comply with the list of allowed drivers. Exploiting this vulnerability allows a remote attacker to execute...

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

EUVD-2026-67714

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078

CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470, CVSS 9.4 Critical) in the database connection utilities of PaperCut NG and PaperCut MF . The application instantiates database driver classes from configurable names without an allowlist, allowing arbitrary Java bytecode to...

VulnCheck KEV: CVE-2026-82078

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained...

CVE-2026-82078: Use of Externally-Controlled Input to Select Classes or Code

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

EUVD-2026-26483

The LabOne Q serialization framework uses a class-loading mechanism importcls to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target...