CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

CVE-2025-24893

CVE-2025-24893 XWiki Remote Code Execution RCE Exploit A Python3 exploit for CVE-2025-24893 , a critical Unauthenticated Remote Code Execution RCE vulnerability affecting the XWiki platform. This script exploits a Code/Expression Injection flaw CWE-95 within the SolrSearch macro component. The fl...

Ofbiz-RCE

📌 Apache OFBiz RCE Exploit CVE-2024-38856 This Python script allows exploiting a Remote Code Execution RCE vulnerability in Apache OFBiz versions 18.12.15 through unauthorized access to the endpoint /webtools/control/forgotPassword/ProgramExport. 🛠️ Description CVE : CVE-2024-38856 Type : Incorrec...

CVE-2025-24893

CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Remote Code Execution An RCE Remote Code Execution category vulnerability, found when unauthenticated attackers can execute arbitrary Groovy code remotely without authentication or prior access Guest User. Below is a PoC Proof-Of-Concept in Python fo...

XWiki-Platform-RCE-CVE-2025-24893

XWiki Platform Unauthenticated RCE Exploit Overview This script is a refurbished Bash implementation of an exploit targeting the XWiki Platform versions affected by CVE-2025-24893. It leverages a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitra...

CVE-2026-52833

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

CVE-2026-78166

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

CVE-2026-78166

A code injection vulnerability was identified in provectus kafka-ui (up to 0.7.2), affecting the Groovy Code Handler component. Specifically, the executeSmartFilterTest function in MessagesController.java can be exploited remotely to inject and execute arbitrary code. The exploit has been release...

CVE-2026-78166 provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

CVE-2026-78166

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

EUVD-2026-64686

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

CVE-2026-78166 provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

CVE-2026-78166: Improper Control of Generation of Code

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

PT-2026-79803

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories blo...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...