claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

CVE-2023-24055

Disclaimer This script is for educational and demonstration purposes only. The author does not endorse or condone the use of this script for any criminal or malicious activities and it should only be used where explicitly allowed with proper permission. This script should be used with caution, as...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC Use java.net.InetAddress for detection POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type: application/xml...

CVE-2025-27136

CVE-2025-27136 Exploiting an XML External Entity XXE Vulnerability. Use XML Payload to Grab Sensitive Files PoC test.xml Use curl to upload test.xml from our local machine to the bucket. curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml Trigger the Exploit & Gr...

CVE-2020-26259

Description XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. Influence Xstream \n" + " \n" + " \n" + " 0\n" + " \n" + " \n" + " \n" + " text/plain\n" + " \n" + " C:\Al1ex.txt\n" + " \n" + " \n" + " \n"...

crack-0.1.8-fixed

= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == note on releases Releases are tagged on github and also released as gems on...

external_expat_AOSP10_r33_CVE-2022-23990

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052 information leak vulnerability in the DMG file parser of ClamAV A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information o...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00'...

CVE-2020-9496

CVE-2020-9496 Las solicitudes XML-RPC son vulnerables a deserialización insegura y problemas de Cross-Site Scripting en Apache OFBiz 17.12.03 Instalar requisitos $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar ...

external_expat_AOSP10_r33_CVE-2022-22822toCVE-2022-22827

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

cve-2023-45612_exploit

cve-2023-45612exploit CVE-2023-45612 is a high severty security probem that allows XXE XML eXternal Entity attacks on Ktor's XML serialization that has been patched in 2023. Reproduction of the security problem Below is a detailed way of how I reproduced the problem. IntelliJ IDEA project First, ...

CVE-2024-45427-Exploit

CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...

watchguard_cve-2022-26318

watchguardcve-2022-26318 Watchguard RCE POC CVE-2022-26318 !/usr/bin/python3 -- coding: utf-8 - - CVE-2022-26318 import socket import ssl import gzip Remote WatchGuard XTM or FireWare OS RHOST = "1.1.1.1" Local host with nc listener: nc -l 8.8.8.8 8888 LHOST = "8.8.8.8" def buildPayloadLHOST:...

external_expact_AOSP10_r33_CVE-2022-25314

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

cve-2025-58360

GeoServer: CVE-2025-58360 Disclaimer The code and information contained within this repository is for educational and research purposes only. The owner of the repository takes no responsibility for anything you do with the code and/or information within this repository. Your actions are your own...

zk-xml-probe

zk-xml-probe Static XML fixtures for authorized bug bounty testing of XML parser behaviour CVE-2026-45071...

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...