zero-trace7/cve-2026-50229
🔴 Advanced Cross-Site Scripting (XSS) Scanner & Exploit for Apache Tomcat Examples Web Application
CVE-2026-50229 is a Cross-Site Scripting (XSS) vulnerability discovered in the bundled examples web application shipped with Apache Tomcat. The flaw exists in the numguess.jsp demo page within webapps/examples/jsp/num/, where unfiltered HTTP request parameters are reflected back to the victim's browser without proper sanitization or escaping.
This repository contains a professional-grade Proof of Concept (PoC) scanner written in Python that automatically detects, exploits, and documents this vulnerability across multiple Tomcat versions.
⚠️ WARNING: This tool is intended for educational purposes and authorized security testing only. Misuse may violate applicable laws. Always obtain explicit permission before testing.
The vulnerability originates from wildcard property mapping in the JSP page:
<jsp:useBean id="numguess" class="num.NumberGuessBean" scope="session"/>
<jsp:setProperty name="numguess" property="*"/>
---
The property="*" maps ALL request parameters to bean properties, including the hint field which is later reflected unescaped:
Good guess, but nope. Try <b><%= numguess.getHint() %></b>.
| Field | Value |
|---|
| CVE ID | CVE-2026-50229 |
| CWE | CWE-79 (Improper Neutralization of Input During Web Page Generation) |
| CVSS Score | 3.1 (Low) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity | Low |
| Availability | None |