Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This repository is intended for educational and research purposes only. All exploit scripts must be used exclusively against systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by...

dawnscanner

Dawnscanner - The raising security scanner for ruby web applications dawn is a source code scanner designed to review your web applications for security issues. The tool is able to scan web applications written in Ruby and it supports all major MVC Model View Controller frameworks, out of the box...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...

cve-2023-34035-mitigations

This repo is a set of samples to demonstrate the arrangements wherein applications may be vulnerable to https://spring.io/security/cve-2023-34035CVE-2023-34035. An application is vulnerable when all of the following are true: Spring MVC is on the classpath DispatcherServlet and at least one other...

apache-struts-cve-2017-9805

The Apache Struts web framework The Apache Struts web framework is a free open-source solution for creating Java web applications. Web applications differ from conventional websites in that web applications can create a dynamic response. Many websites deliver only static pages. A web application...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

name_reverser

== Welcome to Rails Rails is a web-application framework that includes everything needed to create database-backed web applications according to the Model-View-Control pattern. This pattern splits the view also called the presentation into "dumb" templates that are primarily responsible for...

CVE-2022-22965

Spring4Shell Vulnerability - CVE-2022-22965 📕 Introduction The spring4shell vulnerability was named this way due to 2 vulnerabilities found and widely exploited by attackers in early 2022. One of these vulnerabilities is in the framework component called "Spring Cloud Functions" less critical and...

CVE-2026-106146

In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated...

EUVD-2026-124561

In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated...

CVE-2026-106146

In Progress Telerik UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, a vulnerability exists in server-side filter processing. The FilterNodeVisitor component fails to properly validate descriptor types, null values, or stack state, and the assembly fails to catch FilterParserException....

CVE-2026-106137

In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and...

EUVD-2026-123615

In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and...

CVE-2026-106137 ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC

In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and...

CVE-2026-106137

Progress Telerik UI for ASP.NET MVC versions 2012.2.710 through 2026.3.811 are vulnerable to a race condition and memory retention issue in the ClassFactory component. The root cause is the lack of exclusive write protection when updating a shared class dictionary, where non-atomic lookups and in...

PT-2026-145287

In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and...

CVE-2026-106137: Progress Software Telerik UI for ASP.NET MVC: In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a…

In affected versions of Progress® Telerik® UI for ASP.NET MVC 2012.2.710 through 2026.3.811, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and...

CLEANSTART-2026-GW20609 Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks

Security vulnerability affects the apache-nifi package. Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks...