CVE-2023-27372-POC

CVE-2023-27372-POC Overview This code is a Python POC Proof of Concept for detecting whether a target website has the CVE-2023-27372 vulnerability. You can run this code by providing a single URL or a text file containing multiple URLs. Affected version: SPIP "; Features Check whether the target...

CVE-2017-10366_peoplesoft

CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit This script automates the exploitation of a Java deserialization vulnerability in Oracle PeopleSoft, originally discovered by Vahagn Vardanyan. This exploit requires ysoserial.jar to generate cross-platform serialized...

CVE-2022-2992

CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. A vulnerability in GitLab CE/EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve...

CVE-2025-24813-Scanner

CVE-2025-24813 Scanner A multi-threaded vulnerability scanner to detect Apache Tomcat servers vulnerable to CVE-2025-24813 arbitrary file upload leading to RCE. Description This scanner checks for Apache Tomcat servers vulnerable to CVE-2025-24813 by: 1. Attempting to upload a serialized Java...

FallingSkies-CVE-2023-35885

CVE-2023-35885 Cloudpanel 0-day Exploit Author: @EagleTube, @Mzulfahmy, @farphalabs Github : https://github.com/datackmy/FallingSkies-CVE-2023-35885/blob/main/ Affected version: v2.0.0 – v2.3.0 Patched version: v2.3.1 Vendor homepage: CloudPanel.io Product: CloudPanel References:...

CVE-2017-1000353

CVE-2017-1000353 POC How to reproduce the Jenkins CVE-2017-1000353？ Clone this repository, use the pre-built payload jenkinspoc.ser with flowing command: python exploit.py http://your-ip:8080 jenkinspoc.ser Then the touch /tmp/success would be executed. Java Version Requirements Important : The...

weblogic_cve-2019-2890

1）Start the XXER tool python xxer.py -H 192.168.17.223 2）Place the xxer PoC into the xx.xml file, replace the serialized data, and inject the xxer PoC; java -jar weblogicxxe.jar xx.xml 3）Use weblogic.py from the java-deserialization-exploit tool to send data to the Weblogic server python...

CVE-2025-1913-PoC

CVE-2025-1913 -- Proof of Concept PoC This repository contains an educational-only Proof of Concept PoC for CVE-2025-1913 , created by Suhaib518 🇸🇦. This PoC demonstrates how specially crafted serialized PHP input may trigger vulnerable logic in affected WordPress components. The PoC is safe and...

CVE-2022-2992

CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. A vulnerability in GitLab CE/EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve...

CVE-2020-2555

CVE-2020-2555 http://1984-0day.com https://www.youtube.com/watch?v=VzmZTYbm4Zw python CVE-2020-2555.py ip port test.ser...

cve-2022-32224-rails

CVE-2022-3222 ActiveRecord Serialization Behavior Verification https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 https://api.rubyonrails.org/classes/ActiveRecord/AttributeMethods/Serialization/ClassMethods.html...

CVE-2022-30778

Warning The vulnerability has been revoked Override This is Abount CVE-2021-43503. Requirement PHP = 8.0 Composer Recover vulnerability 1. Startup service composer install cp .env.example .env php artisan key:generate php artisan serve it will listening 8000 port in localhost 2. PoC queueResolver...

npm: Seroval: Script injection through RegExp sources in serialized output

npm: Seroval: Script injection through RegExp sources in serialized output vulnerability discovered by ? in WordPress npm seroval versions 1.0.0...

CVE-2026-116796

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796: highcharts: Highcharts JS is a JavaScript charting library based on SVG

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

npm: Serialize JavaScript: Cross-site scripting XSS via unescaped /script at the end of a serialized function body vulnerability discovered by ? in WordPress npm serialize-javascript versions 7.1.3...

CVE-2026-115886

A flaw was found in MLflow. An unauthenticated remote attacker can conduct Server-Side Request Forgery SSRF, where the application is tricked into making unauthorized network requests to arbitrary internal or external systems. By submitting crafted serialized scorer data to affected endpoints, an...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...