tag
Java
Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)
CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…
Alibaba Fastjson 1.x checkAutoType Bypass to Remote Code Execution via jar:http SSRF and fd-Reread Trick (CVE-2026-16723)
CVE-2026-16723 is a critical, unauthenticated remote code execution vulnerability in Alibaba Fastjson 1.2.68 through 1.2.83, actively exploited in the wild against Spring Boot fat-JAR deployments. Under Fastjson stock defaults (AutoType disabled, SafeMode…
Spring Cloud Gateway Actuator RCE — Vulnerable Environment Lab (CVE-2025-41243)
CVE-2025-41243 concerns a SpEL (Spring Expression Language) injection vulnerability in Spring Cloud Gateway that leads to remote code execution when the Actuator gateway management endpoint is exposed. The root cause is that Actuator's gateway routes API…
Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065)
CVE-2025-30065 is an unsafe class-instantiation vulnerability in Apache Parquet Java's parquet-avro module: crafted Avro schema metadata embedded in a Parquet file can force the reading JVM to load and instantiate attacker-named classes. The official 1.15.1…
Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901)
The PoC reproduces a Spring Expression Language (SpEL) injection in a Thymeleaf-rendered template where user-controlled input is reflected into a template expression context without sanitization. By submitting a crafted SpEL payload such as…
Spring Security Lazy Header Writing Security Header Bypass (CVE-2026-22732)
CVE-2026-22732 affects Spring Security's default "lazy" header-writing mechanism, which normally injects security-related response headers (X-Frame-Options, X-Content-Type-Options, Cache-Control, Strict-Transport-Security, etc.) just before the HTTP response…
Spring AI SimpleVectorStore SpEL Injection RCE (CVE-2026-22738)
SimpleVectorStore.similaritySearch() builds a filter expression by concatenating a caller-supplied filterKey parameter directly into a Spring Expression Language (SpEL) string that is then evaluated by a full-featured StandardEvaluationContext. Because that…
Samsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980)
CVE-2026-20980 is the first stage of a three-bug exploit chain against Samsung's AP AT-command handling. The atdistributor daemon filters "protected" AT commands via libpacmclient.so's pacmcheckatcmds, which rejects multi-command payloads by checking for the…
pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000
A vulnerable pac4j JWT configuration accepts unsigned JWTs (alg: "none") and, when JWE encryption is used to wrap tokens, decrypts the outer JWE and trusts the inner JWT's claims without independently verifying that the inner token is signed. The PoC builds…
OpenAM Pre-Authentication RCE via `jato.clientSession` Deserialization (CVE-2026-33439)
OpenAM's unauthenticated Password Reset pages accept a jato.clientSession parameter that is passed to Encoder.deserialize() without any class allowlist/filtering, allowing an attacker to submit an arbitrary serialized Java object graph. The PoC builds a…
Jinjava Server-Side Template Injection to RCE via Jackson ObjectMapper (CVE-2026-25526)
CVE-2026-25526 is a sandbox-escape vulnerability in Jinjava, the Java template engine used by many JVM web applications for user-influenced templating. The PoC shows that Jinjava's rendering context exposes an internal interpreter object (int3rpr3t3r) whose…
Apache Tomcat Tribes EncryptInterceptor Fail-Open Unauthenticated RCE (CVE-2026-34486)
CVE-2026-34486 is a fail-open flaw in Apache Tomcat's Tribes clustering EncryptInterceptor, which is meant to require encrypted, authenticated membership traffic between cluster nodes. Due to the bypass, an attacker can send an unencrypted, crafted message…
Apache Tomcat Split-Collection Security Constraint Bypass (CVE-2026-43515)
CVE-2026-43515 is a security constraint evaluation bug in Apache Tomcat's RealmBase.findSecurityConstraints(). When a single <security-constraint> defines multiple <web-resource-collection> blocks that share the same URL pattern (e.g. .html) but each declare…
Apache Tomcat Mutual TLS OCSP Soft-Fail Authentication Bypass — CVE-2026-29145
When Tomcat is configured to use Mutual TLS (CLIENTCERT) authentication together with OCSP revocation checking in hard-fail mode, it is expected to reject any client certificate whose revocation status cannot be confirmed. This PoC demonstrates that when the…
Apache Solr Velocity Template Injection RCE (CVE-2026-44825)
Apache Solr bundles the Apache Velocity template engine as an optional response writer. Solr's VelocityResponseWriter renders user-supplied Velocity templates passed via the wt=velocity query parameter without adequately restricting access to Java reflection…
Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779)
CVE-2026-42779 is a deserialization filter bypass in Apache MINA's AbstractIoBuffer.resolveClass(). Applications configure an acceptMatchers allowlist to restrict which Java classes ObjectSerializationCodecFactory may deserialize, but the allowlist check is…
Confluence SSTI RCE - CVE-2023-22527
CVE-2023-22527 is a CVSS 10.0 unauthenticated Remote Code Execution vulnerability in Atlassian Confluence Data Center and Server. The vulnerability is a Server-Side Template Injection (SSTI) in the Velocity/Freemarker template engine, reachable via the…
Confluence Post-Auth RCE - CVE-2024-21683
CVE-2024-21683 is an authenticated Remote Code Execution vulnerability in Atlassian Confluence Data Center and Server affecting the "Add a New Language" feature in the Code Macro plugin. An authenticated Confluence administrator can upload a malicious .js…
Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065)
CVE-2025-30065 is an unsafe deserialization issue in Apache Parquet Java schema handling that can instantiate attacker-controlled classes while parsing malicious Parquet/Avro metadata. The provided PoC demonstrates two practical outcomes: arbitrary command…