CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...

sap_igs_xxe

SAP IGS XXE attack CVE-2018-2392 and CVE-2018-2393 This module in Metasploit Framework Documentation Module Vulnerable Application This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers IGS running versions 7.20,...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port...

B-XSSRF

B-XSSRF Toolkit to detect and keep track on Blind XSS, XXE & SSRF SETUP...

CVE-2024-34102

CVE-2024-34102 Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de Restricción Incorrecta de Referencia a Entidades Externas XML 'XXE' que podría resultar en la ejecución de código arbitrario. Un atacante podría explotar esta...

lazyweb

LazyWeb - Vulnerable Web Application LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized with its respective difficulty rating to provide a comprehensive learning experience for developers and security...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

CVE-2018-12463

CVE-2018-12463 XML external entity XXE vulnerability in /ssc/fm-ws/services in Fortify Software Security Center SSC 17.10, 17.20 & 18.10 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request.. Exploit-DB...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC...

evil-ssdp

Resumen Esta herramienta responde a solicitudes de descubrimiento multicast SSDP, haciéndose pasar por un dispositivo UPNP genérico. Tu dispositivo suplantado aparecerá mágicamente en el Explorador de Windows en las máquinas de tu red local. Los usuarios que sean tentados a abrir el dispositivo...

wordpress_cve-2021-29447

wordpresscve-2021-29447 WordPress XXE vulnerability Credit : https://github.com/motikan2010...

CVE-2021-2471

CVE-2021-2471 maven environment Reproduction process here Reference environment: https://github.com/SecCoder-Security-Lab/jdbc-sqlxml-xxe...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-based tool designed to exploit CVE-2024-34102, Remote Code Execution vulnerability. CVE-2024-34102 Detail Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

weblogic_cve-2019-2890

1）Start the XXER tool python xxer.py -H 192.168.17.223 2）Place the xxer PoC into the xx.xml file, replace the serialized data, and inject the xxer PoC; java -jar weblogicxxe.jar xx.xml 3）Use weblogic.py from the java-deserialization-exploit tool to send data to the Weblogic server python...

xxexploiter

XXExploiter It generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration. Installation root@kitploit: install node and npm if you don't have it yet npm install -g xxexploiter Building & Running from source This is a simple Node application...

cve-2017-12629

README Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML...

CVE-2025-58360

CVE-2025-58360 The vulnerability in question is CVE-2025-58360 CVSS score: 8.2, an unauthenticated XML External Entity XXE flaw that affects all versions prior to and including 2.25.5, and from versions 2.26.0 through 2.26.1. It has been patched in versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and...