CVE-2019-2888

CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE Vulnerability https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class root@kitploit: ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

CVE-2021-29447

Installation and Execution Sequence 0. Run Docker root@kitploit: $docker-compose up 1. Execute wordpress.sh Configure the wp-config.php file before installing WordPress. root@kitploit: $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Install WordPress Access the...

CVE-2017-9096-iText-XXE

CVE-2017-9096 1. Creating the malicious PDF containing XXE Get a PDF containing a form: root@kitploit: wget https://www.pdfscripting.com/public/FreeStuff/PDFSamples/ModifySubmitExample.pdf -O input.pdf Decompress PDF To do that you need to decompress the PDF with qpdf --qdf...

fusionauth-samlv2

fusionauth-samlv2 This repository is SAML v2.0 bindings in Java using JAXB. You'd use this library to process SAML requests and responses. See the tests for example code. Security disclosures If you find a vulnerability or other security related bug, please report the vulnerability here before...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

CVE-2025-58360

CVE-2025-58360 From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap Exploit1: root@kitploit: python3 CVE-2025-58360 -u http://example.com...

CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052 information leak vulnerability in the DMG file parser of ClamAV A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information o...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: root@kitploit: --host Mandatory - our IP address for reverse connections...

xxexploiter

XXExploiter Genera los payloads XML y automáticamente inicia un servidor para servir los DTD necesarios o realizar exfiltración de datos. Instalación root@kitploit: install node and npm if you don't have it yet npm install -g xxexploiter Construcción y ejecución desde el código fuente Esta es una...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

Apache Tika - XML External Entity Injection

Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1, and tika-parsers 1.13-1.28.5 contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. id: CVE-2025-66516 info: nam...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...