EUVD-2026-88137

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384

Apache Roller 6.1.5 is vulnerable to an unauthenticated remote code execution (RCE) flaw due to the deserialization of untrusted data (CWE-502). The XmlRpcServlet accepts vendor extension types (e.g., ex:serializable) which are deserialized during request parsing before any authentication occurs....

CVE-2017-11610

CVE-2017-11610 Supervisor 3.0a1 - 3.3.2용 인증 없는 리버스 셸 RCE Supervisor 3.0a13.3.2용 독립 실행형 Python ≥3.6 인증 없는 RCE 익스플로잇으로, 이 Metasploit 모듈에서 재작성되었습니다. 설명은 이 게시물을 참조하세요. Supervisor 3.3.2를 실행하는 이 대상 환경에서 Python 3.7로 테스트했습니다. 사용법: root@Kali:/Infosec/RubyStuff/Supervisor-3.3.2 ./exploit.py -h usage:...

EUVD-2011-3559

Malware in sbrugna...

CVE-2025-9703 Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability...

CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

Drupal Core XML-RPC Endpoint xmlrpc.php Tags Denial of Service (CVE-2014-5266)

A denial of service vulnerability has been reported in Drupal Core. The vulnerability can cause a very high CPU load and memory exhaustion. A remote unauthenticated attacker can exploit this vulnerability to cause a denial of service on the vulnerable system...