text4shell-tools

commons-text-tools Quick links Click to find: Find commons-text .jar files and their versions Calls to commons-text vulnerable functions Hot patch on commons-text .jar files to disable the vulnerable behaviors Scan and patch example Overview CVE-2022-42889 may pose a serious threat to a wide rang...

hot-jar-swapping-urlclassloader

URLClassLoader hot jar swapping The following example code shows the ability to hot jar swap an already loaded JAR-file and get code execution by abusing the fact that inner classes still access the JAR file when invoked, as long as the inode does not change. Tested on MacOS with OpenJDK And also...

cve_2011_3556

CVE-2011-3556 — Proof of Concept PoC Disclaimer This tool is a Python 3 implementation of an existing proof of concept PoC made by mihi for the Metasploit Framework. Prerequisites To use the module, simply follow the instructions below: root@kitploit: Clone this repository locally. $ git clone...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker Unauthenticated Remote Code Execution via /worker/deployContainer Arbitrary JAR Loading 1. Summary The PowerJob Worker exposes the deployContainer handler on its HTTP transport port 27777 with no authentication whatsoever. An attacker submits an arbitrary URL; the Worker downloads...

Xjar_tips

Xjartips Introduction: root@kitploit: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...

jvmtiAgentLoad-Exploit

Arbitrary code execution via jvmtiAgentLoad Description: Tools and code for generating a malicious JAR to exploit jvmtiAgentLoad Usage: root@kitploit: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Linux Target The following command generates a JAR mal.jar that...

marshalsec-jar

marshalsec-jar Needed the file for a test...

CVE-2021-44228_scanner

CVE-2021-44228scanner Las aplicaciones vulnerables al problema log4j CVE-2021-44228 pueden ser detectables escaneando archivos jar, war y ear en busca de la presencia de JndiLookup.class. Dependiendo de la plataforma que esté investigando, puede tener más sentido ejecutar el script de PowerShell ...

CVE-2021-44228

Rol de Ansible para Mitigación de Log4Shell CVE-2021-44228 Este rol de Ansible despliega un script basado en Python para mitigar programáticamente la vulnerabilidad Log4Shell CVE-2021-44228 eliminando la clase vulnerable JndiLookup de los archivos JAR de Log4j afectados. Está diseñado para...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

EUVD-2026-75174

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication...

zipdefrag

Este volcado es un rompecabezas o parseo avanzado a escopetazos para necios y rebeldes érase una vez Érase una vez, querido lector, en una noche oscura y tormentosa, su fiel autor se topó con una situación desconcertante y misteriosa: un sistema donde lo único que impedía el análisis de memoria p...

CVE-2026-0848

CVE-2026-0848 — NLTK StanfordSegmenter: Arbitrary Code Execution via Untrusted JAR Loading -red?style=for-the-badge -brightgreen?style=for-the-badge Overview...

local-log4j-vuln-scanner

Simple local log4j vulnerability scanner Written in Go because, you know, "write once, run anywhere." This is a simple tool that can be used to find vulnerable instances of log4j 1.x and 2.x in installations of Java software such as web applications. JAR and WAR archives are inspected and class...

log4jhound

log4jhound Bash script that detects Log4j occurences in your projects and systems: unpacks JARs and analyzes their Manifest files, text search in source code. Usage: ./log4jhound.sh rootdirectory...

CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ WARNING This code executes arbitrary commands on your system. Use ONLY in virtual machines or isolated containers. Description Functional PoC for CVE-2026-0848. Demonstrates how a malicious JAR file can execute arbitrary code when loaded by NLTK...

CVE-2026-22812-OpenCode-RCE-exp

CVE-2026-22812-OpenCode-RCE-exp Método de uso: java -jar xxx.jar Entorno recomendado: jdk8...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015

Open WebUI versions 0.6.27 through 0.11.1 are affected by a session cookie leakage flaw in backend/open_webui/utils/tools.py . The cookie jar from the enclosing connection loop was not bound to each external tool callable, so when multiple tool servers were attached and a session or system OAuth ...

CVE-2026-16723

🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType Resource Probe Chain RCE A reproduction project for remote class loading / command execution in fastjson 1.2.66 1.2.83 via the@JSONType annotation + an illegal class name + the jar: protocol. ⚠️ Disclaimer This project is intended solely for security...