Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2019-0232

CVE-2019-0232 — Apache Tomcat CGI Servlet RCE Educational PoC for authorized CTF / penetration testing only. Running this against systems you do not own or have explicit written permission to test is illegal. Vulnerability Overview CVE-2019-0232 is a Remote Code Execution vulnerability in Apache...

CVE-2023-22047

Description: CVE-2023-22047 is unauthentication read file on oracle-peoplesoft. However, advance exploit attacker can use this vulnerability to execute remote code execution. In the peoplesoft application "Portal.war"," Serlet "WSRP Consumer ResourceProxy" enables the ability to read files and ma...

Confluence-EvilJar

aaaademo/Confluence-EvilJar Use CVE-2023-22515 to upload a jar package via the backend to achieve RCE. git clone https://github.com/aaaademo/Confluence-EvilJar cd Confluence-EvilJar mvn package CMDshell http://confluence.local/plugins/servlet/testbin/cmServlet Godzilla webshell connection method...

CVE-2019-0232

CVE-2019-0232 Vulnerability analysis and PoC for the Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution RCE Video PoC available at https://www.youtube.com/watch?v=RA7kzuHOWqA Details Apache Tomcat has a vulnerability in the CGI Servlet, which can be exploited to achieve remot...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2019-8451

CVE-2019-8451 Jira Unauthenticated SSRF Vulnerability python usage python CVE-2019-8451.py http://www.jas502n.com:8080 root@kali:/CVE-2019-8451 python CVE-2019-8451.py http://www.jas502n.com:8080 SSRF URL: www.baidu.com Send poc Success! X-AUSERNAME= anonymous vulnurl=...

damn-vulnerable-log4j-app

SnapAttack Log4j / CVE-2021-44228 / log4shell Resources What's included? Damn Vulnerable Log4j App damn-vulnerable-log4j-app contains a basic vulnerable Java Servlet that logs the User Agent, HTTP GET and POST parameters with log4j. It is packaged as a .war file and can be deployed to servers lik...

CVE-2019-0232

CVE-2019-0232 Exploit Remote Code Execution RCE in CGI Servlet – Apache Tomcat on Windows Refference : https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ Apache Tomcat has a vulnerability in the CGI Servlet which ca...

CVE-2012-4431

Welcome to Apache Tomcat! What Is It? The Apache Tomcat® software is an open source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. The Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket specifications are...

web-inf-path-trav

WebXMLExp.py Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications. This tool is referenced in the Invicti Security white paper Exploiting path traversal vulnerabilities in Java web applications. Install Python3 is required for this tool. Run the followin...

jetty_9.4.31_CVE-2023-26048

Eclipse Jetty Canonical Repository This is the canonical repository for the Jetty project, feel free to fork and contribute now! Submitting a patch or pull request? Make sure you have an Eclipse Contributor Agreement ECA on file. eclipse.org/legal/ecafaq Project description Jetty is a lightweight...

confluence-hack

Confluence Hack CVE-2023-22515 exploit.py Exploit to create a new admin user Compromised audit log: As a reverence served: https://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html and https://github.com/Chocapikk/CVE-2023-22515 pluginshellplug.j...

apache__jspwiki_CVE-2022-46907_2-11-3

Apache JSPWiki 2.11 - Documentation Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License,...

jetty_9.4.31_CVE-2021-34428

Eclipse Jetty Canonical Repository This is the canonical repository for the Jetty project, feel free to fork and contribute now! Submitting a patch or pull request? Make sure you have an Eclipse Contributor Agreement ECA on file. eclipse.org/legal/ecafaq Project description Jetty is a lightweight...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. 0x00 Dork shodan title:"GoAnywhere" FOFA title="GoAnywhere" 0x01 Use Java Version java -version openjdk...

OracleOTM

OracleOTM Python tool for exploiting CVE-2021-35616 The script works in modules, which I implemented in the following order: ► Username enumeration ► Search for default credentials ► Run an SQL query using DBXML servlet ► Full exploitation and JSP execution The syntax of the script is as follows:...

SAP_EEM_CVE-2020-6207

PoC for CVE-2020-6207 Missing Authentication Check in SAP Solution Manager This script allows to check and exploit missing authentication checks in SAP EEM servlet tcsmdagentapplicationeem that lead to RCE on SAP SMDAgents connected to SAP Solution Manager Original finding: Pablo Artuso Yvan 'igg...

CVE-2020-9484

CVE-2020-9484 Tomcat For educational purposes only. See Reference for the details. Run $ git clone https://github.com/masahiro331/CVE-2020-9484.git $ cd CVE-2020-9484 $ docker build -t tomcat:groovy . $ CONTAINER=docker run -d -p 8080:8080 tomcat:groovy Check clean $ docker exec -it $CONTAINER ls...