368 matches found
struts2_cve-2017-5638
struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...
CVE-2017-5638
CVE-2017-5638 Apache Struts 2.0 RCE vulnerability This is a script to exploit CVE-2017-5638 - It allows an attacker to inject OS commands into a web application through the content-type header Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It...
CVE-2017-5638
CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...
CVE-2017-5638
CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...
CVE-2017-5638
CVE-2017-5638 Apache Struts 2.3.5 Example:...
XworkStruts-RCE
XworkStruts-RCE CVE-2017-5638 XworkStruts RCE Vuln test script The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrar...
CVE-2017-5638
LAB 1 — Apache Struts2 OGNL Injection CVE-2017-5638 / S2-045 I. SYSTEM ANALYSIS Attack Surface Analysis After starting the container, Struts2 logs show that the application loads familiar configuration files such as struts-default.xml , struts-plugin.xml , and struts.xml. This confirms that the...
S2-045-EXP-POC-TOOLS
CNVD-ID CNVD-2017-02474 Release Date 2017-03-07 Hazard Level High AV:N/AC:L/Au:N/C:C/I:C/A:C Affected Products Apache Struts =2.3.5, =2.5, CVE Identifier CVE-2017-5638 Problem It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value...
PoC-CVE-2017-5638
PoC: Apache Struts2 CVE-2017-5638 Safe Educational Demo 📌 Overview This project is a Proof-of-Concept PoC for CVE-2017-5638 , a famous Apache Struts2 vulnerability that allowed attackers to execute arbitrary code on affected servers. ⚠️ This repository contains a safe, non-exploitative demo...
PT-2026-121400
Name of the Vulnerable Software and Affected Versions multer versions 2.0.0 through 2.4.9 Description A race condition exists in the multipart parser when configured with an asynchronous fileFilter function. If a request is aborted while an asynchronous fileFilter is still pending, the callback m...
Exploit for CVE-2026-109618
PHP: PHP2Shell CVE-2026-109618 and CVE-2026-109619 PHP CVE-20...
CVE-2026-41508
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...
CVE-2026-41508 OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...
CVE-2026-41508: Protection Mechanism Failure
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...
CLEANSTART-2026-DN02833 carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
Security vulnerability affects the apache2 package. A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts...
Exploit for Improper Handling of Exceptional Conditions in Apache Struts
Struts Patch-Gap Auditor A small Python tool that finds Apach...
EUVD-2026-63829
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name...
Apache Struts2 Content-Type OGNL RCE (CVE-2017-5638)
Exploits CVE-2017-5638 in Apache Struts 2.3.x/2.5.x via OGNL injection in the Content-Type header Jakarta multipart parser. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 Jakarta multipart OGNL RCE CVE-2017-5638.""" import re from kittysploit...
Astra Linux – Vulnerability in Ruby-Rack
Rack is a modular Ruby web server interface. In versions 3.0.0.beta1 through 3.1.21, and from 3.2.0 through 3.2.6, Rack::Multipart::Parserhandlemimehead parsed quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated Stringindex searches combined with...