CVE-2017-12615

CVE-2017-12615 Usage: CVE-2017-12615.py http://targetip:port When ops retardedly enable put method in web.xml on Apache Tomcat 7.0.0 - 7.0.79 this EXP should be working...

CVE-2019-0232

Vulnerability Environment root@kitploit: Tomcat 8.5.39 Jdk 8u121 Edit web.xml file root@kitploit: cgi org.apache.catalina.servlets.CGIServlet debug 0 cgiPathPrefix WEB-INF/cgi-bin executable 5 cgi /cgi-bin/ Edit file...

CVE-2019-0232

Vulnerability Environment root@kitploit: Tomcat 8.5.39 Jdk 8u121 Edit web.xml file root@kitploit: cgi org.apache.catalina.servlets.CGIServlet debug 0 cgiPathPrefix WEB-INF/cgi-bin executable 5 cgi /cgi-bin/ Edit file...

web-inf-path-trav

WebXMLExp.py Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications. This tool is referenced in the Invicti Security white paper Exploiting path traversal vulnerabilities in Java web applications. Install Python3 is required for this tool. Run the followin...

CVE-2026-84839

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-84839 tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-84839 tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-84839

tsi-coop tsi-dpdp-cms (up to 0.5.0 ) is affected by a missing authentication vulnerability in the web.xml file of the Admin Console/DPO Compliance Console component. A remote attacker can access the console without authentication, leading to a partial confidentiality impact. The exploit has been ...

EUVD-2026-70253

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

PT-2026-84850

Name of the Vulnerable Software and Affected Versions tsi-coop tsi-dpdp-cms versions prior to 0.5.1 Description A flaw exists in the Admin Console/DPO Compliance Console component within the web.xml file. A remote attacker can perform a manipulation that results in missing authentication, allowin...

CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-73574

Zimbra Collaboration versions before 10.1.17 are affected by a local file inclusion (LFI) vulnerability in the Forward servlet of the Classic Web Client. The root cause is improper validation of the fu request parameter, allowing an unauthenticated attacker to supply a crafted path and disclose p...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-18047

Removed by vendor...

CVE-2026-55956

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources. Mitigation Review your...

Always-Incorrect Control Flow Implementation

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization constraints are...

CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

Fixed in Apache Tomcat 10.1.56

Moderate: Security constraints for default servlet ignored method CVE-2026-55956 If security constraints were specified for the default servlet, any method or method omission configured as part of the constraint was ignored. This was fixed with commit 9c3b1efb. This issue was reported to the Tomc...