EUVD-2026-75387

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2026-87962

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2017-10366_peoplesoft

CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit This script automates the exploitation of a Java deserialization vulnerability in Oracle PeopleSoft, originally discovered by Vahagn Vardanyan. This exploit requires ysoserial.jar to generate cross-platform serialized...

CVE-2020-2555

CVE-2020-2555 http://1984-0day.com https://www.youtube.com/watch?v=VzmZTYbm4Zw root@kitploit: python CVE-2020-2555.py ip port test.ser...

weblogic_cve-2019-2890

1）Start the XXER tool python xxer.py -H 192.168.17.223 2）Place the xxer PoC into the xx.xml file, replace the serialized data, and inject the xxer PoC; java -jar weblogicxxe.jar xx.xml 3）Use weblogic.py from the java-deserialization-exploit tool to send data to the Weblogic server python...

FallingSkies-CVE-2023-35885

CVE-2023-35885 Cloudpanel 0-day Exploit Author: @EagleTube, @Mzulfahmy, @farphalabs Github : https://github.com/datackmy/FallingSkies-CVE-2023-35885/blob/main/ Affected version: v2.0.0 – v2.3.0 Patched version: v2.3.1 Vendor homepage: CloudPanel.io Product: CloudPanel References:...

CVE-2022-30778

Warning The vulnerability has been revoked Override This is Abount CVE-2021-43503. Requirement PHP = 8.0 Composer Recover vulnerability 1. Startup service root@kitploit: composer install cp .env.example .env php artisan key:generate php artisan serve it will listening 8000 port in localhost 2...

CVE-2022-2992

CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. A vulnerability in GitLab CE/EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve...

CVE-2025-24813-Scanner

CVE-2025-24813 Scanner A multi-threaded vulnerability scanner to detect Apache Tomcat servers vulnerable to CVE-2025-24813 arbitrary file upload leading to RCE. Description This scanner checks for Apache Tomcat servers vulnerable to CVE-2025-24813 by: 1. Attempting to upload a serialized Java...

CVE-2023-27372-POC

CVE-2023-27372-POC Overview This code is a Python POC Proof of Concept for detecting whether a target website has the CVE-2023-27372 vulnerability. You can run this code by providing a single URL or a text file containing multiple URLs. Affected version: SPIP "; Features Check whether the target...

CVE-2022-2992

CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. A vulnerability in GitLab CE/EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve...

CVE-2017-1000353

CVE-2017-1000353 POC How to reproduce the Jenkins CVE-2017-1000353？ Clone this repository, use the pre-built payload jenkinspoc.ser with flowing command: root@kitploit: python exploit.py http://your-ip:8080 jenkinspoc.ser Then the touch /tmp/success would be executed. Java Version Requirements...

cve-2022-32224-rails

CVE-2022-3222 ActiveRecord Serialization Behavior Verification https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 https://api.rubyonrails.org/classes/ActiveRecord/AttributeMethods/Serialization/ClassMethods.html...

CVE-2025-1913-PoC

CVE-2025-1913 -- Proof of Concept PoC This repository contains an educational-only Proof of Concept PoC for CVE-2025-1913 , created by Suhaib518 🇸🇦. This PoC demonstrates how specially crafted serialized PHP input may trigger vulnerable logic in affected WordPress components. The PoC is safe and...

CVE-2026-82797

A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service DoS by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data. Mitigation Update...

CVE-2026-82797

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51...

UBUNTU-CVE-2026-82797

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51...

CVE-2026-82797

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51...

EUVD-2026-68482

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51...

CVE-2026-82797

An uncontrolled recursion vulnerability exists in Samsung Open Source rlottie , triggered by serialized data with nested payloads, leading to a denial of service. The affected component is the deserialization path in rlottie, and the issue is rated CVSS 3.1 5.5 (MEDIUM) with a local attack vector...