## https://sploitus.com/exploit?id=009582B0-A117-58F9-B059-4FFE4A28073E
# ⚡ CVE-2026-50229 — Apache Tomcat Examples XSS Exploit
<p align="center">
<img src="https://img.shields.io/badge/CVE-2026--50229-red?style=for-the-badge&logo=apache" alt="CVE-2026-50229">
<img src="https://img.shields.io/badge/Severity-Low-yellow?style=for-the-badge" alt="Severity">
<img src="https://img.shields.io/badge/CVSS-3.1-orange?style=for-the-badge" alt="CVSS">
<img src="https://img.shields.io/badge/Type-XSS-critical?style=for-the-badge" alt="XSS">
<img src="https://img.shields.io/badge/Apache-Tomcat-ff0055?style=for-the-badge&logo=apachetomcat" alt="Apache Tomcat">
</p>
<p align="center">
<img src="https://img.shields.io/github/stars/ZERO-TRACE/CVE-2026-50229?style=social" alt="Stars">
<img src="https://img.shields.io/github/forks/ZERO-TRACE/CVE-2026-50229?style=social" alt="Forks">
<img src="https://img.shields.io/github/license/ZERO-TRACE/CVE-2026-50229?style=flat" alt="License">
<img src="https://img.shields.io/badge/Python-3.8+-blue?style=flat&logo=python" alt="Python">
<img src="https://img.shields.io/badge/Platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey?style=flat" alt="Platform">
</p>
<p align="center">
<b>🔴 Advanced Cross-Site Scripting (XSS) Scanner & Exploit for Apache Tomcat Examples Web Application</b>
</p>
---
## 📌 Overview
**CVE-2026-50229** is a **Cross-Site Scripting (XSS)** vulnerability discovered in the **bundled examples web application** shipped with **Apache Tomcat**. The flaw exists in the `numguess.jsp` demo page within `webapps/examples/jsp/num/`, where unfiltered HTTP request parameters are reflected back to the victim's browser **without proper sanitization or escaping**.
This repository contains a **professional-grade Proof of Concept (PoC)** scanner written in Python that automatically detects, exploits, and documents this vulnerability across multiple Tomcat versions.
> ⚠️ **WARNING**: This tool is intended for **educational purposes** and **authorized security testing only**. Misuse may violate applicable laws. Always obtain explicit permission before testing.
---
## 🎯 Vulnerability Details
| Field | Value |
|-------|-------|
| **CVE ID** | CVE-2026-50229 |
| **CWE** | CWE-79 (Improper Neutralization of Input During Web Page Generation) |
| **CVSS Score** | 3.1 (Low) |
| **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | None |
| **User Interaction** | Required |
| **Scope** | Changed |
| **Confidentiality** | Low |
| **Integrity** | Low |
| **Availability** | None |
### 🔍 Root Cause
The vulnerability originates from **wildcard property mapping** in the JSP page:
```jsp
<jsp:useBean id="numguess" class="num.NumberGuessBean" scope="session"/>
<jsp:setProperty name="numguess" property="*"/>
---
```
The property="*" maps ALL request parameters to bean properties, including the hint field which is later reflected unescaped:
```jsp
Good guess, but nope. Try <b><%= numguess.getHint() %></b>.