CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

This module exploits the OVSwrap nested-action length wrap on an affected Linux x86-64 kernel. It writes a generated Core Impact agent ELF to the target, creates a private user/network namespace, leaks kernel pointers through OVS actions, reads kernel memory, and applies a targeted 32-bit decrement to the local ProxyCall process credential. To bridge Generic Netlink, the module uploads and runs a statically linked Linux x86-64 transport ELF. The helper creates its own private user/network namespace; all CVE-specific exploit logic and kernel-build records remain in this module. The module writes a temporary passwordless sudo rule and runs the generated agent through sudo. It removes the rule after a root agent connects when it used a sudoers drop-in. The kernel must provide Open vSwitch, conntrack labels and FTP helper support, and allow unprivileged user/network namespaces. A matching embedded kernel-build record is preferred; otherwise local symbols, BTF or unstripped objects, and pahole are required for dynamic derivation. At least 2 GiB RAM is recommended.

This module remotely exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

Windows HTTP.sys is vulnerable to an integer overflow while calculating the size required for HTTP response headers. The resulting undersized nonpaged-pool allocation can be overflowed while HTTP.sys generates the response headers, producing a heap-based buffer overflow. This module executes an exploit binary in memory. The exploit uses the memory corruption to build arbitrary kernel read and write primitives, then replaces the current agent process token with the SYSTEM process token. The steps performed by the exploit are: Prepare a local HTTP server and a crafted HTTP response Spray named-pipe data queue entries in the nonpaged pool Trigger the integer overflow and corrupt an adjacent data queue entry Build arbitrary kernel read and write primitives Locate the current agent and SYSTEM process objects Copy the SYSTEM process token to the current agent process

This module exploits CVE-2026-59310, a directory traversal vulnerability in the Syslog server component of VMware vCenter Server to deploy an Core Impact OSCI agent. The module will use the vulnerability to create a log file inside the /opt/vmware/share/htdocs/configurev2/ directory and then verify the result via a HTTP GET request to the /configurev2 endpoint via the 5480 port with a random filename terminated in the "-syslog.log" string. Then, the module will try to erase the created log file by using the vulnerability again to create a cron file inside the /etc/cron.d/ directory. The cron job will autodelete itself. If the target is vulnerable, the module will deploy an Core Impact OSCI agent with capabilities to execute commands as root. Due to the way the vulnerability is exploited, no command output is possible, so Core Impact OSCI agent terminal commands will be marked as blind.

This module performs the following steps: 1. Checks whether the Drupal i18n_sso token endpoint is present. 2. Submits a random token as a negative control and verifies that it is rejected. 3. Sends unauthenticated wildcard-token requests to the Drupal i18n_sso login endpoint. 4. Repeats the wildcard request according to MAX ATTEMPTS and POLL INTERVAL until a matching active token is found. 5. Confirms the authentication bypass only when Drupal reports success and returns a valid Drupal session cookie. 6. Uses the acquired session to identify the authenticated Drupal account. 7. Stores the session cookie as an Impact identity and records CVE-2026-16639 on the target.

A Windows Component Based Servicing elevation of privilege vulnerability allows a local attacker to make a SYSTEM TiWorker process load an unsigned sibling dpx.dll from a controlled OnePackage metadata directory. The module performs the following steps: Generates a per-run CORE Impact agent DLL named dpx.dll. Copies the target's installed, signed UpdateAgent.dll and builds a reduced DesktopDeployment cabinet with the controlled dpx.dll. Builds a small standalone OnePackage carrier on the target by using the Windows makecab utility. Executes the CBS helper directly from memory without writing the helper executable to the target filesystem. Invokes the public CBS Session COM endpoint and evaluates applicability without staging, installing, or committing the package. Causes UpdateAgent.dll to load the controlled sibling dpx.dll inside TiWorker.exe.

CVE-2026-48908 affects JoomShaper SP Page Builder versions 6.6.1 and earlier. The asset.uploadCustomIcon task accepts an icon-font ZIP without authentication or a CSRF token. The module sends a valid multipart icon-font package in the custom_icon field. The vulnerable component extracts the archive below media/com_sppagebuilder/assets/iconfont/name/, a location normally served by the Joomla web server. The archive contains a randomly named, token-guarded PHP file in the fonts directory. The module first requests that file with a harmless marker to distinguish file write from server-side PHP execution. It then uses the same endpoint to deliver the selected Linux Impact agent. Successful execution depends on the target web server allowing PHP execution for the extracted media directory. If the upload succeeds but PHP is not executed there, the target is file-write vulnerable but is not confirmed as remote code execution by this module. The agent runs with the privileges of the Joomla/PHP service account, commonly www-data on Linux Apache deployments. No administrator credentials are required.

CVE-2026-48908 affects JoomShaper SP Page Builder versions 6.6.1 and earlier. The asset.uploadCustomIcon task accepts an icon-font ZIP without requiring authentication or a CSRF token. The module sends a valid multipart icon-font package in the custom_icon field. The vulnerable component extracts the archive below media/com_sppagebuilder/assets/iconfont/name/, a location normally served by the Joomla web server. The archive contains a randomly named, token-guarded PHP file in the fonts directory. The module first requests that file with a harmless marker to distinguish file write from server-side PHP execution. It then uses the same endpoint to deliver the selected Linux Impact agent. Successful execution depends on the target web server allowing PHP execution for the extracted media directory. If the upload succeeds but PHP is not executed there, the target is file-write vulnerable but is not confirmed as remote code execution by this module. The agent runs with the privileges of the Joomla/PHP service account, commonly www-data on Linux Apache deployments. No administrator credentials are required. Linux agent delivery uses curl because standard Joomla PHP/Apache images commonly include curl without wget. The selected Impact web server must be reachable from the target container.