CVE-2025-24813

CVE-2025-24813 Apache Tomcat - 通过会话反序列化实现远程代码执行 未认证的部分PUT + 路径遍历 + 小工具驱动的反序列化 描述 启用了默认 Servlet PUT 功能（readonly=false）的 Apache Tomcat 实例允许通过 HTTP PUT 请求写入文件。通过构造一个能跨越上传目录路径并指向 FileStore 会话存储位置的路径，攻击者可以将精心构造的序列化 Java 对象作为 .session 文件植入。后续引用该会话的请求会触发反序列化，执行嵌入的小工具链。 前置条件 在 conf/web.xml 中配置默认 Servlet...

CVE-2025-32434

CVE-2025-32434: PyTorch RCE Vulnerability - PoC What is CVE-2025-32434? CVE-2025-32434 is a critical Remote Code Execution RCE vulnerability in PyTorch, a widely used Python library for deep learning and neural networks. The Core Problem The vulnerability exists in the torch.load function, even...

misfortune-cookie

Suite de PoC para CVE-2014-9222 "Misfortune Cookie" Desbordamiento de pila en el manejo de cookies HTTP de AllegroSoft RomPager todas las versiones 4.34. Una única solicitud no autenticada con una cabecera Cookie: manipulada corrompe la memoria. Efectos: bypass de autenticación de administrador,...

log4shell-exploitation-detection

Log4Shell CVE-2021-44228: Explotación, Detección y Remediación Un proyecto práctico de seguridad ofensiva y defensiva que simula el ciclo de vida completo de la vulnerabilidad Log4Shell: explotación desde una VM controlada por el atacante, ingeniería de detección en Splunk y remediación validada...

CVE-2026-39987-PoC

PoC de CVE-2026-39987 Resumen Marimo = 0.20.4 se ve afectado por una vulnerabilidad de RCE previa a la autenticación en el endpoint WebSocket /terminal/ws. El endpoint verifica el modo de la aplicación y la compatibilidad con terminal, pero no valida la autenticación antes de aceptar la conexión...

react2shell-toolkit

Next.js RCE 评估工具包 一个用于在授权环境中验证和调查 CVE-2025-55182（也称为 React2Shell ）的 Python 工具包。该漏洞影响 React 服务端组件，并可能使基于 Next.js 等框架构建的应用程序暴露于未经身份验证的远程代码执行。该工具包集成了目标收集、批量验证、交互式测试 Shell、主机枚举以及可选的后验证工具。 漏洞 CVE: CVE-2025-55182 名称: React2Shell 类型: 未经身份验证的远程代码执行 受影响技术: React 服务端组件及依赖框架，包括受影响的 Next.js 配置 工具包验证:...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

wp2shell

🔍 wp2shell - WordPress CVE-2026-63030 漏洞扫描器与利用工具 ⚡ 针对 CVE-2026-63030 wp2shell 的快速实时漏洞扫描器与利用工具 📌 概述 wp2shell 是一个用于检测和利用 CVE-2026-63030 的综合性工具包，该漏洞是 WordPress 中的一个严重漏洞，允许未经身份验证的攻击者通过 REST API 批量路由混淆结合 SQL 注入来执行远程代码。 🔍 什么是 CVE-2026-63030？ CVE-2026-63030（wp2shell）是由 Adam Kues （Assetnote / Searchlight...

Preproduce-CVE-2019-0232

CVE-2019-0232 - Ejecución Remota de Código en Apache Tomcat CGI Servlet Este repositorio proporciona un entorno de laboratorio basado en Docker para reproducir la vulnerabilidad CVE-2019-0232 en Apache Tomcat 9.0.17 en Windows. Resumen de la Vulnerabilidad CVE-2019-0232 es una vulnerabilidad de...

CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP响应不安全反序列化复现器 CVE-2026-40859 本项目演示了 Apache Camel 的 camel-netty-http 和 camel-vertx-http 组件中的一个 Java 反序列化漏洞 ，编号为 CVE-2026-40859 。当生产者端点配置了 transferException=true（或组件级别的 allowJavaSerializedObject=true）时，后端 HTTP 响应 带有失败状态和 Content-Type:...

abdal-cve-2026-63030

English | فارسی 🛡️ Exploits PoC de Abdal CVE-2026-63030 Abdal CVE-2026-63030 es un verificador defensivo de exposición para WordPress que detecta la confusión de rutas en el endpoint por lotes de la API REST, rastreada como CVE-2026-63030. El problema puede encadenarse con CVE-2026-60137 en...

CVE-2017-12615

CVE-2017-12615 - Apache Tomcat 远程代码执行 CVE-2017-12615 是一个影响 Apache Tomcat 7.0.0 至 7.0.79 在 Microsoft Windows 上运行的远程代码执行漏洞，前提是 HTTP PUT 请求已被启用。 该漏洞存在的原因是当 DefaultServlet 的 readonly 参数设置为 false 时，Tomcat 对上传的 JSP 文件处理不当。在这种情况下，未经身份验证的攻击者可以直接向 Web 服务器上传恶意 JSP 文件，并通过请求该文件执行任意 Java 代码。...

patch-CVE-2026-28001

Parche: CVE-2026-28001 Detalles de la Vulnerabilidad CVE : CVE-2026-28001 Producto : Splunk Enterprise Descripción : Ejecución remota de código en el análisis de SPL Severidad : Crítica Estado del Parche: DESPLEGADO...

RCE-CVE-2026-10520-CVE-2026-10523

CVE-2026-10520 y CVE-2026-10523 Un generador de artefactos de detección de omisión de autenticación y ejecución remota de código en Ivanti Sentry. Consulte nuestra publicación del blog para obtener detalles técnicos. Detección en acción root@kitploit: $ python3 CVE-2026-10523.py --url...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia Remote Code Execution RCE CVE-2026-34197 is a high severity Remote Code Execution RCE vulnerability affecting Apache ActiveMQ Classic. The issue exists within the Jolokia JMX-HTTP bridge, which exposes management operations over HTTP through the...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...