arslanben/richfaces-paint2d-lab

PoC

Deliberately vulnerable CTF lab reproducing CVE-2018-12533 (RichFaces Paint2DResource EL injection) end to end.

view exploit source poc_in_githubauthor arslanbenpublished 2026-10-01catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-12533US	critical9.8	18.7% (97th)	Exploit	2018-06-18
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.