Deserialization – core-jmp

// Deserialization

3 posts

Bypassing Windows Application Control: insecure deserialisation in imgmgr.exe (CVE-2026-25166)

Windows Application Control (formerly WDAC) blocks binaries that are not signed by an approved authority — but a Microsoft-signed binary that deserialises…

oxfemale· Aug 10· 14 min ·793

Fail Open, Game Over: Turning a One-LineTomcat Fix into Unauthenticated RCE

Apache Tomcat249

Apache Tomcat Deserialization

Fail Open, Game Over: Turning a One-LineTomcat Fix into Unauthenticated RCE

A flaw in Apache Tomcat Tribes clustering allows attackers to send crafted cluster messages that bypass authentication and trigger unsafe deserialization, leading…

oxfemale· Apr 14· 11 min ·249

AI Agents199

AI Agents Deserialization

Exploiting a PHP Object Injection in Profile Builder Pro in the era of AI

The article explains how researchers exploited an unauthenticated PHP Object Injection in the WordPress plugin Profile Builder Pro, showing how AI tools…

oxfemale· Mar 20· 21 min ·199