BardLaudian/CVE-2023-49070

PoC

Apache OFBiz XML-RPC pre-auth deserialization RCE PoC (CVE-2023-49070) — auth bypass + ysoserial gadget chain via /webtools/control/xmlrpc

view exploit source poc_in_githubauthor BardLaudianpublished 2026-09-24catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2023-49070US	critical9.8	95.4% (100th)	Exploit	2023-12-05
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.