CVE-2020-14882

CVE-2020-14882 Oracle WebLogic Server Authentication Bypass Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0and 14.1.1.0.0. Easily exploitable vulnerability...

CVE-2024-21182

Oracle WebLogic Server JNDI Vulnerability For educational purpose only...

CVE-2024-21006

1、Nothing much to say, it's just an LDAP exploitation. 2、Please check the LDAP service request log. 3、The target version needs Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0. And a low-version JDK is required. 4、Use JNDIExploit-1.4-SNAPSHOT.jar to start the LDAP service...

cve-2020-14882

CVE-2020-14882 Affected versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 POC: root@kitploit: http://IP:7001/console/images/%252E%252E%252Fconsole.portal?nfpb=false&pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession"java.lang.Runtime.getRuntime.exec'calc.exe';";...

POC-CVE-2026-60206

CVE-2026-60206 — Oracle WebLogic SAML Auth Bypass CVSS 9.9 — SAML authentication bypass in Oracle WebLogic Server Core. Affected: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0 ⚠️ Authorized security testing only. Install root@kitploit: git clone https://github.com/imbas007/CVE-2026-60206.git cd...

CVE-2024-21182

Oracle WebLogic Server JNDI Vulnerability...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

CVE-2024-21006

CVE-2024-21006 CVE-2024-21006 Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T...

CVE-2021-2302

CVE-2021-2302 Author: quynhle Gadget chain root@kitploit: javax.management.BadAttributeValueExpException.readObject oracle.security.jps.az.internal.common.principals.toString oracle.security.jps.az.internal.common.principals.getResolvedPrincipal . . . con.newInstance...

cve-2019-2618

cve-2019-2618 Weblogic Upload Vulnerability Requires username password - CVE-2019-2618 Python Usage root@kitploit: python CVE-2019-2618.py url username password Decrypt Weblogic Password root@kitploit: root@f0cb7e674d7e:/Oracle cat...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp root@kitploit: CVE20202551...

CVE-2024-21006_PoC

CVE-2024-21006 PoC CVE-2024-21006 is a critical Remote Code Execution RCE vulnerability affecting Oracle WebLogic Server. The flaw is related to the insecure use of the IIOP Internet Inter-ORB Protocol and JNDI Java Naming and Directory Interface protocols, allowing an unauthenticated remote...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...

CVE-2024-21182

CVE-2024-21182 — Oracle WebLogic Server T3/IIOP JNDI Injection → RCE lab A self-contained, one-command Docker lab to reproduce and validate the Oracle WebLogic Server OpaqueReference JNDI-injection vulnerability family CVE-2024-21182, a patch bypass of CVE-2023-21839 and turn it into...

CVE-2026-60206

🚨 CVE-2026-60206 — WebLogic SAML Takeover Oracle WebLogic Server SAML Authentication Vulnerability A technical analysis of CVE-2026-60206 affecting Oracle WebLogic Server. 📖 Overview CVE-2026-60206 is a Critical CVSS 9.9 vulnerability affecting Oracle WebLogic Server. According to Oracle, a...

CVE-2017-10271

LAB 2 - CVE-2017-10271: WebLogic XMLDecoder Deserialization Writeup I. System Analysis System Log Analysis Detected Service: Oracle WebLogic Server AdminServer belonging to basedomain running in Development Mode. Connection Port: 7001. Supported Protocols: http, t3, iiop, ldap, snmp. Attack Surfa...

CVE-2020-14882

CVE-2020-14882 This script enables remote code execution RCE on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server. Exploit Details Exploit Title: Oracle...

CVE-2021-2109

CVE-2021-2109 Weblogic Server Remote Code Execution Vulnerability Reproduction and Analysis In January 2021, Oracle released a security update patch, including 329 new security patches in the Oracle product family. This announcement specifically mentioned the Oracle WebLogic Server security...

CVE-2019-2618

PoC root@kitploit: POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic...

CVE-2020-14883

CVE-2020-14883 Oracle WebLogic Server Authenticated Remote Code Execution RCE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily...