[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":66,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":73,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":79,"vulnerability-29607":86},[4,15,23,28,36,42,48,54,60],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"wp2shell (Vuln DB homepage)","wp2shell-vuln-db","Emergency CVE response: detection & exploitation now available for *wp2shell*, the critical WP RCE chain","https://pentest-tools.com/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451",false,[11],"/vulnerabilities-exploits/","See CVE details","secondary","wp2shell",{"title":16,"slug":17,"text":18,"link":19,"external":9,"targets":20,"cta":22,"variant":13,"campaign_id":14},"wp2shell (CVE page - exploitation)","wp2shell-cve-page-exploit","Validate wp2shell exposure & mitigation! Detect with any plan. Exploit with Pentest Suite.","https://pentest-tools.com/pricing",[21],"/vulnerabilities-exploits/wp2shell-wordpress-core-690-694-and-700-701-pre-auth-batch-route-confusion-leading-to-sql-injection_29452","Explore plans",{"title":24,"slug":25,"text":18,"link":19,"external":9,"targets":26,"cta":22,"variant":13,"campaign_id":14},"wp2shell (CVE page - detection)","wp2shell-cve-page",[27],"/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451",{"title":29,"slug":30,"text":31,"link":32,"external":9,"targets":33,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Homepage","compliance-pages-launch","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.","https://pentest-tools.com/usage/compliance",[34],"/","Get compliance evidence",{"title":37,"slug":38,"text":39,"link":32,"external":9,"targets":40,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[41],"/exploit-helpers/sniper",{"title":43,"slug":44,"text":45,"link":32,"external":9,"targets":46,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?",[47],"/network-vulnerability-scanning/network-security-scanner-online",{"title":49,"slug":50,"text":51,"link":32,"external":9,"targets":52,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[53],"/website-vulnerability-scanning/website-scanner",{"title":55,"slug":56,"text":57,"link":32,"external":9,"targets":58,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[59],"/features/integrations",{"title":61,"slug":62,"text":63,"link":32,"external":9,"targets":64,"cta":35,"variant":13,"campaign_id":30},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[65],"/features/pentest-reporting",["Island",67],{"key":68,"params":69,"result":71},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":70},"{}",{"head":72},{},["Island",74],{"key":75,"params":76,"result":77},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":70},{"head":78},{},["Island",80],{"key":81,"params":82,"result":84},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":83},"{\"text-color\":\"gray\"}",{"head":85},{},{"id":87,"detectable_with":88,"vuln_details":95,"vuln_id":114,"name":115,"published":116,"updated":96},29607,{"tool":89,"engine":92},{"id":90,"name":91},1,"Network Scanner",{"id":93,"name":94},2,"Nuclei",{"id":87,"codename":96,"description":96,"severity":97,"risk_description":98,"public_description":99,"public_recommendation":100,"recommendation":96,"references":101,"cvssv3":108,"epss_score":109,"epss_percentile":110,"cve":111,"in_cisa_catalog":9,"date":113,"software_type":96,"vendor":96,"product":96,"ptt_exploit_capabilities":96},null,"critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.","Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.",[102,103,104,105,106,107],"https://nvd.nist.gov/vuln/detail/CVE-2015-7501","https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822","https://github.com/ianxtianxt/CVE-2015-7501","https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE","https://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html",9.8,0.83274,0.99654,[112],"CVE-2015-7501","2017-11-09T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2015-7501","Red Hat JBoss - Insecure Deserialization","2026-08-18T00:00:00Z"]