CVE-2015-7501

Laboratorio para Vulnerabilidades de Deserialización en Java Este contenido está relacionado con el artículo escrito para la 12.ª edición de la revista H2HC. Vea el artículo completo en: https://www.h2hc.com.br/revista/ Las diapositivas y el video de la charla estarán disponibles próximamente. Un...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

CVE-2026-55220

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

heyserial

مرحبًا سيريال! المؤلف: أليسا رحمان @ramen0x3f تاريخ الإنشاء: 2021-10-27 آخر تحديث: 2021-12-02 المدونة: https://www.mandiant.com/resources/hunting-deserialization-exploits لمزيد من التفاصيل حول هذه الأداة وعملية البحث وراءها، اطّلع على مدونتنا. الوصف أنشئ قواعد صيد لاستغلال إلغاء التسلسل برمجيًا...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

ysoserial.net

Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti .NET. Description ysoserial.net è una raccolta di utility e di "gadget chains" di programmazione orientata alle proprietà scoperte in librerie .NET comuni che possono, nelle giuste...

react2shellexploitvisualized

Visualizzazione di React2Shell CVE-2025-55182 Una visualizzazione educativa interattiva che spiega la vulnerabilità React2Shell - una critica falla di esecuzione remota di codice con CVSS 10.0 nei React Server Components. Cos'è Un percorso guidato narrato in 5 fasi che spiega: 1. SSR tradizionale...

CVE-2021-3129

CVE-2021-3129 Laravel = v8.4.2 modalità di debug: esecuzione remota di codice CVE-2021-3129 Ho modificato l'exploit del maestro @crisprss https://github.com/crisprss/LaravelCVE-2021-3129EXP aggiungendo più gadget utilizzabili per l'enumerazione. Uso: root@kitploit: python3 exp.py...

ysoserial

ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Rilasciato originariamente come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con catene di gadget per Apac...

ysoserial

ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Originariamente rilasciato come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con gadget chain per Apache...

GadgetProbe

Descrizione Hai appena trovato un bug di deserializzazione Java, hai eseguito tutti i tuoi payload ysoserial e... non hai ottenuto nulla. E adesso? Come puoi fare debug o costruire una catena di gadget se sei completamente cieco? Ecco GadgetProbe, uno strumento che fa luce sui classpath remoti e...

phpggc

PHPGGC: PHP Generic Gadget Chains PHPGGC ist eine Bibliothek vonunserialize-Payloads sowie ein Werkzeug, um diese von der Kommandozeile oder programmatisch zu erzeugen. Wenn Sie auf einer Website auf ein unserialize stoßen, deren Code Sie nicht haben, oder einfach ein Exploit bauen möchten,...

QLinspector

QLinspector Finden von Java/C-Gadget-Chains mit CodeQL. Weitere Informationen in unserem Artikel Installation Repository klonen root@kitploit: $ git clone https://github.com/synacktiv/QLinspector.git Nach Gadgets suchen: root@kitploit: $ codeql database analyze log4j --format=sarif-latest...

CVE-2025-24813

مجموعة أدوات استغلال CVE-2025-24813 هذه أداة استغلال متقدمة وآلية لـ CVE-2025-24813 ، تستهدف خوادم Apache Tomcat المعرضة لثغرة إلغاء تسلسل الجلسة غير الآمنة. 🔍 الميزات مسح متعدد الأهداف من ملف أو عنوان URL واحد --targets / --url اختبار تلقائي لسلاسل الأدوات CommonsCollections1-7, BeanShell, Sprin...

PT-2026-70089

Name of the Vulnerable Software and Affected Versions JBoss marshalling affected versions not specified Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

EUVD-2026-52894

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554

CVE-2026-70554 affects MaxSite CMS. It describes an unauthenticated PHP object injection via the maxsite_comuser cookie, where unvalidated serialized data is passed directly to unserialize(), allowing an attacker to reconstruct object graphs and trigger magic methods. This can enable property-ori...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

EUVD-2026-40388

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including...