Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ Questo strumento è creato esclusivamente per uso educativo. L'uso non autorizzato al di fuori di ambienti controllati è severamente vietato. CVE-2025-59287 è una vulnerabilità critica di esecuzione di codice remoto in Microsoft Windows Server Update Services WSUS. Deriva da una...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Übersicht Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2022-46364 , eine Local File Inclusion LFI-Sicherheitslücke in Apache CXF. Die Sicherheitslücke entsteht durch unsachgemäße Handhabung von XOP XML-binary Optimized Packaging...

Information Disclosure

Keycloak is vulnerable to Information Disclosure. The vulnerability is due to differing error responses in the SAML ECP endpoint, where specially crafted SOAP requests with varying client IDs can trigger distinct faultstring values. An unauthenticated attacker can use these responses to determine...

PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling

A flaw was found in the PHP SoapServer component. When the server is configured to maintain session persistence, an error during a SOAP request can cause the system to incorrectly manage memory. This can lead to a "use-after-free" vulnerability, where the system attempts to use memory that has...

php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability

A flaw was found in PHP's SOAP extension. This vulnerability allows a remote attacker to execute arbitrary code on the affected system. The issue stems from a use-after-free error in the object deduplication mechanism, which can be triggered by sending a specially crafted SOAP request. This allow...

CVE-2026-9794 Keycloak: keycloak: information disclosure via saml ecp endpoint

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP Security Assertion Markup Language Enhanced Client or Proxy endpoint with varying client IDs. By observing distinct faultstrings in the...

CVE-2026-9794

Keycloak contains an information-disclosure flaw (CVE-2026-9794) where a remote, unauthenticated attacker can send crafted SOAP requests to the SAML ECP endpoint and observe differing faultstrings to infer the client protocol type. This is the scoped impact reported across NVD/Red Hat CVE entries...

📄 Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution

This script is a Python-based proof of concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server's WLS-WSAT component. The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the...

CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

BridgeHead FileStore versions prior to 24A released in early 2024 expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console...

(Pwn2Own) HP DeskJet 2855e JobStatusEvent Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of HP DeskJet 2855e printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When handling a JobStatusEvent, the...

CVE-2026-33373

An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...

Zyxel EX3510-B0 UPnP command injection vulnerability

The Zyxel EX3510-B0 is a Gigabit Ethernet switch produced by Zyxel Technology. The Zyxel EX3510-B0 UPnP device has a command injection vulnerability related to UPnP SOAP requests. This vulnerability stems from incorrect filtering of input parameters, allowing remote attackers to execute arbitrary...

The vulnerability of the UPnP protocol implementation in Zyxel network devices allows a hacker to execute arbitrary code.

The vulnerability of the UPnP protocol implementation in Zyxel network devices’ microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted SOAP requests...

CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...

CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...

EUVD-2025-207551

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...