zero-trace7/cve-2026-50229Automated XSS scanner and proof-of-concept exploit for CVE-2026-50229 in Apache Tomcat examples. Detects and exploits reflected cross-site scripting via unescaped JSP parameters.
🔴 Advanced Cross-Site Scripting (XSS) Scanner & Exploit for Apache Tomcat Examples Web Application
CVE-2026-50229 is a Cross-Site Scripting (XSS) vulnerability discovered in the bundled examples web application shipped with Apache Tomcat. The flaw exists in the numguess.jsp demo page within webapps/examples/jsp/num/, where unfiltered HTTP request parameters are reflected back to the victim's browser without proper sanitization or escaping.
This repository contains a professional-grade Proof of Concept (PoC) scanner written in Python that automatically detects, exploits, and documents this vulnerability across multiple Tomcat versions.
⚠️ WARNING: This tool is intended for educational purposes and authorized security testing only. Misuse may violate applicable laws. Always obtain explicit permission before testing.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-50229 |
| CWE | CWE-79 (Improper Neutralization of Input During Web Page Generation) |
| CVSS Score | 3.1 (Low) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity | Low |
| Availability | None |
The vulnerability originates from wildcard property mapping in the JSP page:
<jsp:useBean id="numguess" class="num.NumberGuessBean" scope="session"/>
<jsp:setProperty name="numguess" property="*"/>
---
The property="*" maps ALL request parameters to bean properties, including the hint field which is later reflected unescaped:
Good guess, but nope. Try <b><%= numguess.getHint() %></b>.