Sploitus

CVE-2016-4437

14 known exploits for CVE-2016-4437

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected products
Apache Shiro, Ubuntu
Apache Aurora
< 0.18.1
Apache Shiro
< 1.2.5
Fix
Available
CVSS 3.1
9.8 CRITICAL
EPSS
93.0% (100th percentile)
Weakness
CWE-321
NVD status
Analyzed
Published
2016-06-07
CVE-2016-4437 at NVD
Authoritative description, scoring and affected products

14 known exploits for CVE-2016-4437

Proof-of-concept code and exploit modules indexed by Sploitus

cve-2016-4437
2026-09-13 KitPloitKITPLOIT
CVE-2016-4437
2026-09-13 KitPloitKITPLOIT
Awesome_shiro
2026-09-12 KitPloitKITPLOIT
CVE-2016-4437
2026-09-12 KitPloitKITPLOIT
shisoserial
2026-09-07 KitPloitKITPLOIT
CVE-2016-4437
2026-09-06 KitPloitKITPLOIT
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
2022-12-10 openKylinGITEE
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
2020-11-03 零度咖啡2016GITEE
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
2020-10-08 0xdawnGITEE
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
2020-05-27 bkfishGITHUB
Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit)
2020-05-01 MetasploitEXPLOITDBRuby
Apache Shiro 1.2.4 Remote Code Execution Exploit
2020-04-30 l-codesZDTRuby
Apache Shiro 1.2.4 Remote Code Execution
2020-04-29 LPACKETSTORMRuby
Apache Shiro v1.2.4 Cookie RememberME Deserial RCE
2016-06-07 L / l-codes <L / l-codes@qq.com>METASPLOITRuby