CVE-2025-55182
Author: trilogy-group
None
GitHub Link:
https://github.com/trilogy-group/react2shell-scan
Author: trilogy-group
None
GitHub Link:
https://github.com/trilogy-group/react2shell-scan
CVE-2013-0156.zip
2.3 KB
CVE-2013-0156
Author: 7s26simon
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Link:
https://github.com/7s26simon/CVE-2013-0156
Author: 7s26simon
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Link:
https://github.com/7s26simon/CVE-2013-0156
CVE-2025-13780.zip
2 KB
CVE-2025-13780
Author: zeropwn
None
GitHub Link:
https://github.com/zeropwn/pgadmin4-9.10-CVE-2025-13780
Author: zeropwn
None
GitHub Link:
https://github.com/zeropwn/pgadmin4-9.10-CVE-2025-13780
CVE-2020-1938.zip
16.3 KB
CVE-2020-1938
Author: abrewer251
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web app...
Author: abrewer251
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web app...
CVE-2025-55182
Author: VolksRat71
None
GitHub Link:
https://github.com/VolksRat71/react2shellexploitvisualized
Author: VolksRat71
None
GitHub Link:
https://github.com/VolksRat71/react2shellexploitvisualized