{"vulnerability": "CVE-2023-21931", "sightings": [{"uuid": "a3b8d37b-7e4a-4244-9edb-32107dc195fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "0af7288e-aea9-4c35-b1f4-57e1495e2870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:51.000000Z"}, {"uuid": "2e8ef9fa-2ab9-4eeb-9218-809a4564e7a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:00.000000Z"}, {"uuid": "8051e912-c1f0-417f-8584-5bbc5bbfb282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://gist.github.com/Darkcrai86/a421ca996c85082f1cba4fb74e7a2252", "content": "", "creation_timestamp": "2025-10-20T06:59:38.000000Z"}, {"uuid": "8845765a-7e0a-4412-a307-670d7dd3a28d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb", "content": "", "creation_timestamp": "2023-06-09T19:18:50.000000Z"}, {"uuid": "95c83003-47bd-4451-a13c-52487f34ea4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "Telegram/5bsa606bXjsOCnyR_mPi7t9er2l-2IxhwH_oS6E71xUxEQ", "content": "", "creation_timestamp": "2023-10-24T18:11:26.000000Z"}, {"uuid": "138d923e-a4f0-4a4f-afe6-677653b054c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/2889", "content": "Tools - Hackers Factory\n\u200b\u200bCVE-2023-21931\n\nWeblogic CVE-2023-21931 vulnerability exploration technique: post-deserialization exploitation.\n\nhttps://github.com/gobysec/Weblogic\n\n\u200b\u200bmisp-galaxy\n\nClusters and elements to attach to MISP events or attributes (like threat actors).\n\nhttps://github.com/MISP/misp-galaxy\n\n\u200b\u200bSandbox Escape in vm2@3.9.15\n\nThere exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.\n\nhttps://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c\n\n\u200b\u200bNetlas dorks\n\nIn this document, you will find dorks for the Netlas.io search engine. They are divided into several categories, each dork also has a link by which you can immediately go to the query results. The dork list from RedTeamGuide was taken as a basis, and processed in accordance with our syntax. If you find any inaccuracies, please feel free to send pull requests or write Issues.\n\nhttps://github.com/netlas-io/netlas-dorks\n\n\u200b\u200bDefault Credentials Cheat Sheet\n\nOne place for all the default credentials to assist pentesters during an engagement, this document has several products default login/password gathered from multiple sources.\n\nhttps://github.com/ihebski/DefaultCreds-cheat-sheet\n\n\u200b\u200bLinkedInDumper\n\nPython 3 script to dump company employees from #LinkedIn API.\n\nhttps://github.com/l4rm4nd/LinkedInDumper\n\n\u200b\u200bFoundry PoC Template\n\nThis is a foundry template to run quick and easy Proof of Concept (PoC) fork tests. It is intended to be used as a starting point for writing PoCs tests for vulnerabilities on any EVM compatible network. It is not intended to be used as a final PoC.\n\nhttps://github.com/Elpacos/quickfork\n\n\u200b\u200bPhishpedia \n\nA Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages.\n\nhttps://github.com/lindsey98/Phishpedia\n\n\u200b\u200bswagroutes\n\nA command-line tool that extracts and lists API routes from Swagger files in YAML or JSON format. It simplifies the process of fetching the routes provided by an API and supports processing multiple files or directories at once.\n\nhttps://github.com/amalmurali47/swagroutes\n\n\u200b\u200bMischief-DLL-Stager\n\nReasonably undetected shellcode stager and executer. This is a very simple shellcode stager that as of right now moderately undetected. I chose to legitimately load functions and then dynamically load others to be less immedialtely suspicious.\n\nhttps://github.com/MitchHS/Mischief-DLL-Stager\n\n\u200b\u200bGC2\n\nCommand and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrate data using Google Drive.\n\nhttps://github.com/looCiprian/GC2-sheet\n\n\u200b\u200bAwesome EDR Bypass\n\nhttps://github.com/tkmru/awesome-edr-bypass\n\n\u200b\u200bSubGPT\n\nSubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to predict and find more. Best part? It's free!\n\nhttps://github.com/s0md3v/SubGPT\n\n\u200b\u200bGpuDecryptShellcode\n\nXOR-decrypting shellcode on the GPU using OpenCL.\n\nhttps://github.com/eversinc33/GpuDecryptShellcode\n\n\u200b\u200bEDR Telemetry\n\nThis project aims to compare and evaluate the telemetry of various EDR products.\n\nhttps://github.com/tsale/EDR-Telemetry\n\n\u200b\u200bgh-action-pip-audit\n\nA GitHub Action that uses pip-audit to scan Python dependencies for known vulnerabilities.\n\nhttps://github.com/pypa/gh-action-pip-audit\n\n\u200b\u200bCVE-2023-25136\n\nOpenSSH Pre-Auth Double Free CVE-2023-25136 POC\n\nhttps://github.com/adhikara13/CVE-2023-25136\n\n\u200b\u200bMalSeclogon\n\nA little tool to play with the Seclogon service.\n\nhttps://github.com/antonioCoco/MalSeclogon\n\nFull technical details at:\n\u2022 https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html\n\u2022 https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html\n\n#infosec #cybersec \n\nhttps://t.me/dilagrafie\nhttps://t.me/HackerFactory", "creation_timestamp": "2023-04-21T07:55:20.000000Z"}, {"uuid": "cc853a1d-2663-4a75-abab-15cbf554a223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/8149", "content": "#exploit\n1. CVE-2022-22956, CVE-2022-22957:\nVMware Workspace ONE RCE\nhttps://packetstormsecurity.com/files/171918\n\n2. CVE-2023-25136:\nOpenSSH Pre-Auth Double Free\nhttps://github.com/adhikara13/CVE-2023-25136\n\n3. CVE-2023-21931:\nWebLogic After-Deserialization\nhttps://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md", "creation_timestamp": "2023-04-21T02:07:48.000000Z"}, {"uuid": "31097894-8046-430e-a1a9-cddb6cc51d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9253", "content": "#exploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\nhttps://securityonline.info/microsoft-exchange-server-rce-cve-2023-36745-flaw-gets-poc-exploit\n]-> PoC: https://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056", "creation_timestamp": "2024-12-26T17:03:29.000000Z"}, {"uuid": "9de23107-9c61-4ebb-9616-18903190d724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/Rootsec_2/1503", "content": "#exploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\nhttps://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056", "creation_timestamp": "2024-08-16T08:40:05.000000Z"}, {"uuid": "d6f08028-b899-4911-a408-bdc8a725632a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://t.me/cissp/6785", "content": "exploit\n1. CVE-2022-22956, CVE-2022-22957:\nVMware Workspace ONE RCE\nhttps://packetstormsecurity.com/files/171918\n\n2. CVE-2023-25136:\nOpenSSH Pre-Auth Double Free\nhttps://github.com/adhikara13/CVE-2023-25136\n\n3. CVE-2023-21931:\nWebLogic After-Deserialization\nhttps://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defense Today,\nSecure Tomorrow\n@CisoasaService\n1402.02.01", "creation_timestamp": "2026-09-01T17:00:21.131787Z"}, {"uuid": "4c608d67-bd42-4893-aca2-af5eb348a59e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://t.me/cissp/7288", "content": "Reversing\nAttacking Cisco RG/OpenRG modem\nhttps://reverse.put.as/2023/10/20/attacking-the-heart-of-an-openrg-modem\n\nexploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\ud83e\udd76\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\ud83e\udd13\ud83e\udd78\nhttps://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056\n\n\n\u2069-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.08.02", "creation_timestamp": "2026-09-01T17:00:16.438524Z"}, {"uuid": "7c74456a-1a0d-453e-a637-95a96400609c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://t.me/cissp/6785", "content": "exploit\n1. CVE-2022-22956, CVE-2022-22957:\nVMware Workspace ONE RCE\nhttps://packetstormsecurity.com/files/171918\n\n2. CVE-2023-25136:\nOpenSSH Pre-Auth Double Free\nhttps://github.com/adhikara13/CVE-2023-25136\n\n3. CVE-2023-21931:\nWebLogic After-Deserialization\nhttps://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defense Today,\nSecure Tomorrow\n@CisoasaService\n1402.02.01", "creation_timestamp": "2026-09-02T01:04:01.244273Z"}, {"uuid": "a6c21459-e2cc-49fd-a2f0-3376b42ba9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://t.me/cissp/7288", "content": "Reversing\nAttacking Cisco RG/OpenRG modem\nhttps://reverse.put.as/2023/10/20/attacking-the-heart-of-an-openrg-modem\n\nexploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\ud83e\udd76\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\ud83e\udd13\ud83e\udd78\nhttps://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056\n\n\n\u2069-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.08.02", "creation_timestamp": "2026-09-02T01:03:53.258401Z"}, {"uuid": "cd8c8763-46df-4dc2-be25-db0ea43ec12e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"4ra1n\", \"14m3ta7k\", \"Grant Willcox\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated\\n          remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes\\n          a \\\"ForeignOpaqueReference\\\" class object, deserializes it on the target, and then post deserialization, calls the\\n          object's \\\"getReferent()\\\" method, which will make use of the \\\"ForeignOpaqueReference\\\" class's \\\"remoteJNDIName\\\" variable,\\n          which is under the attackers control, to do a remote loading of the JNDI address specified by \\\"remoteJNDIName\\\" via\\n          the \\\"lookup()\\\" function.\\n\\n          This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting\\n          a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to\\n          create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java\\n          code during the instantiation of the object, thereby getting remote code execution as the \\\"oracle\\\" user.\\n\\n          This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will\\n          then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java\\n          class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file,\\n          at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate\\n          an instance of that class, granting us RCE as the \\\"oracle\\\" user.\\n\\n          This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability\", \"disclosure_date\": \"2023-01-17\", \"fullname\": \"exploit/multi/iiop/cve_2023_21839_weblogic_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/iiop/cve_2023_21839_weblogic_rce\", \"references\": [\"CVE-2023-21839\", \"URL-https://www.oracle.com/security-alerts/cpujan2023.html\", \"URL-https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md\", \"URL-https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md\", \"URL-http://web.archive.org/web/20230831012940/https://github.com/4ra1n/CVE-2023-21839\", \"URL-https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability\"], \"rport\": 7001, \"session_types\": false, \"targets\": [\"Linux\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:24.690365Z"}, {"uuid": "fed35dd2-693d-4793-8e56-9ac09f8e2107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/cissp/7288", "content": "Reversing\nAttacking Cisco RG/OpenRG modem\nhttps://reverse.put.as/2023/10/20/attacking-the-heart-of-an-openrg-modem\n\nexploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\ud83e\udd76\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\ud83e\udd13\ud83e\udd78\nhttps://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056\n\n\n\u2069-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.08.02", "creation_timestamp": "2026-09-09T20:00:07.221080Z"}, {"uuid": "95aad343-a2bd-4b04-98d7-915377880545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/cissp/7288", "content": "Reversing\nAttacking Cisco RG/OpenRG modem\nhttps://reverse.put.as/2023/10/20/attacking-the-heart-of-an-openrg-modem\n\nexploit\n1. CVE-2023-21931:\nOracle Weblogic PreAuth RCE\ud83e\udd76\nhttps://github.com/MMarch7/weblogic_CVE-2023-21931_POC-EXP\n\n2. CVE-2023-36745:\nMS Exchange Server Privilege Escalation\ud83e\udd13\ud83e\udd78\nhttps://github.com/N1k0la-T/CVE-2023-36745\n\n3. CVE-2023-4863:\nHeap buffer overflow in Google WebP\nhttps://paper.seebug.org/3056\n\n\n\u2069-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1402.08.02", "creation_timestamp": "2026-09-10T00:00:22.907823Z"}, {"uuid": "84c38588-6c54-4450-a1b9-397d242d4727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6785", "content": "exploit\n1. CVE-2022-22956, CVE-2022-22957:\nVMware Workspace ONE RCE\nhttps://packetstormsecurity.com/files/171918\n\n2. CVE-2023-25136:\nOpenSSH Pre-Auth Double Free\nhttps://github.com/adhikara13/CVE-2023-25136\n\n3. CVE-2023-21931:\nWebLogic After-Deserialization\nhttps://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defense Today,\nSecure Tomorrow\n@CisoasaService\n1402.02.01", "creation_timestamp": "2026-09-10T01:00:04.286326Z"}, {"uuid": "081b4130-7b29-49fc-83cf-785cbf05e736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-21931", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6785", "content": "exploit\n1. CVE-2022-22956, CVE-2022-22957:\nVMware Workspace ONE RCE\nhttps://packetstormsecurity.com/files/171918\n\n2. CVE-2023-25136:\nOpenSSH Pre-Auth Double Free\nhttps://github.com/adhikara13/CVE-2023-25136\n\n3. CVE-2023-21931:\nWebLogic After-Deserialization\nhttps://github.com/gobysec/Weblogic/blob/main/Research%20on%20WebLogic%20After-Deserialization.md\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defense Today,\nSecure Tomorrow\n@CisoasaService\n1402.02.01", "creation_timestamp": "2026-09-11T00:00:56.673567Z"}]}