CVE-2020-17453-PoC

CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. PoC Proof of Concept https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Discoverers Name: Jackson Henry Twitter: @JacksonHHax Name: Nicholas Young...

CVE-2022-29464

WSO2 Arbitrary File Upload to Remote Command Execution RCE https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 Example python3 exploit.py https://target.org:9443 shell.jsp...

Mass-exploit-CVE-2022-29464

Meow Meow Meow! Just a Mass Exploit based on a Python PoC for WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Meow Meow Meow? Requirements? Python3 Shodan Zoomeye A Brain What is this tool? This is a mass-autoscan-exploit of CVE-2022-29464 based on the PoC wrote in python by a...

CVE-2022-29464-mass

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Write by Chocapikk lightely modded by trhacknon Usage python exploit.py -u or: python exploit.py -f Zoomeye Dork CLI: zoomeye search 'title:"WSO2 Management Console"' -num 10 -filter=ip,port WEB: title:"WSO2 Management Console"...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

nmap-CVE-2022-29464

nmap-CVE-2022-29464 nmap-CVE-2022-29464 is an NSE script for detecting CVE-2022-29464 vulnerability. Unauthorized and unrestricted arbitrary file transfer vulnerability that allows unauthenticated attackers to obtain RCEs on WSO2 servers by sending malicious JSP files. Vulnerability See good...

CVE-2022-29464

CVE-2022-29464 WSO2 is a leading provider of various SOA solutions, including SOA-related infrastructure, technical frameworks, and related tools, process servers, application servers, etc. Affected Versions 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Serv...

wso2-rce-cve-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading...

carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 Usage • This exploit can only be run for multi targets python3 exploit.py --file urls.txt References https://github.com/hakivvi/CVE-2022-29464...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

CVE-2022-29548

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

CVE-2022-29464

WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is a serious flaw in WSO2. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to upload malicious JSP files to WSO2 servers and get Remote Code Execution RCE. the vulerable upload rou...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 is a critical vulnerability in WSO2 Identity Server, an open-source identity and access management platform. The vulnerability allows remote attackers to upload malicious JSP files that can execute arbitrary commands on the target system with administrative privilege...

CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE Usage : python3 exploit.py https://host:9443/ ArbitraryShellName.jsp...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

WSO2-2021-1258

WSO2-2021-1258: Zip Slip vulnerability in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the WSO2 Management Console. Remote code execution may be obtained by writing/overwriting specific files. Vendor Disclosure: The vendor's disclosure and fix for this...