Apache OFBiz < 18.12.10 - Arbitrary Code Execution

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. id: CVE-2023-49070 info: name: Apache OFBiz 18.12.10 - Arbitrary Code Execution author: your3cho severity: critical description: | Pre-auth RCE in Apach...

Apache OFBiz 17.12.03 - Cross-Site Scripting

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. id: CVE-2020-9496 info: name: Apache OFBiz 17.12.03 - Cross-Site Scripting author: dwisiswant0 severity: medium description: Apache OFBiz 17.12.03 contains cross-site scripting a...

CVE-2020-9496

CVE-2020-9496 ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión XML-RPC request are vulnerable to unsafe deserialization. Steps Step 1: pip3 install -r requeriments.txt Step 2: nc -nlvp attack computer Step 3: python3 shell.py -i -p -li -lp Step 4: You should have a shell in your nc liste...

WordpressPingbackPortScanner

WordpressPingbackPortScanner Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using...

CVE-2026-108900

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900

A SQL injection vulnerability exists in Exponent CMS up to version 3.0.2patch2 . The flaw is located within the userLogin function of the xmlrpc.php file in the XML-RPC component. This vulnerability allows for remote execution of unauthorized SQL commands. While the exploit has been disclosed to ...

EUVD-2026-97502

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

PT-2026-110634

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 3.0.2patch3 Description An issue exists in the XML-RPC component within the userLogin function of the xmlrpc.php file. This flaw allows a remote attacker to perform SQL injection, which is a technique used to...

CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges...

CVE-2026-88827

The Disable Users WordPress plugin (versions through 1.0.5 ) contains a vulnerability where account-disabling controls are not enforced across all authentication paths. This allows users whose accounts have been disabled by an administrator to bypass the restriction and continue authenticating wi...

Exploit for Incorrect Default Permissions in Supervisord Supervisor

Supervisord XML-RPC RCE CVE-2017-11610 Vulhubhttps://vul...

[SECURITY] Fedora 45 Update: php-pecl-xmlrpc-1.0.0~rc3-20.fc45

This extension provides functions to write XML-RPC servers and clients. You can find more information about XML-RPC at http://www.xmlrpc.com/, and more documentation on this extension and its functions at https://www.php.net/xmlrpc. The extension is unbundled from php-src as of PHP 8.0.0, because...

Exploit for CVE-2026-82384

CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization...

CVE-2026-82384

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82377

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384

Apache Roller 6.1.5 is vulnerable to an unauthenticated remote code execution (RCE) flaw due to the deserialization of untrusted data (CWE-502). The XmlRpcServlet accepts vendor extension types (e.g., ex:serializable) which are deserialized during request parsing before any authentication occurs....