[2026-07-09T07:20:38+00:00] Java version: openjdk version "25.0.3" 2026-04-21
[2026-07-09T07:20:38+00:00] Extracting Tomcat 10.1.55
[2026-07-09T07:20:38+00:00] Extracting Tomcat 10.1.56
[2026-07-09T07:20:38+00:00] Testing original CVE-2026-50229 trigger on vulnerable 10.1.55
[2026-07-09T07:20:38+00:00] ===== vulnerable: numguess.jsp original XSS check =====
[2026-07-09T07:20:39+00:00] Starting vulnerable on port 18080
[2026-07-09T07:21:59+00:00] ERROR: vulnerable failed to start
[2026-07-09T07:21:59+00:00] Original trigger on vulnerable: not_vulnerable
[2026-07-09T07:21:59+00:00] Testing original CVE-2026-50229 trigger on fixed 10.1.56
[2026-07-09T07:21:59+00:00] ===== fixed: numguess.jsp original XSS check =====
[2026-07-09T07:22:00+00:00] Starting fixed on port 18080
[2026-07-09T07:22:03+00:00] fixed is healthy
[2026-07-09T07:22:03+00:00] fixed: numguess.jsp XSS payload NOT found
[2026-07-09T07:22:03+00:00] Original trigger on fixed: not_vulnerable
[2026-07-09T07:22:03+00:00] Testing candidate variant JSPs on fixed 10.1.56
[2026-07-09T07:22:03+00:00] ===== fixed: colrs.jsp wildcard-binding candidate check =====
[2026-07-09T07:22:04+00:00] Starting fixed on port 18080
[2026-07-09T07:22:07+00:00] fixed: colrs.jsp did NOT render unescaped XSS payload
[2026-07-09T07:22:07+00:00] colrs.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:22:07+00:00] ===== fixed: carts.jsp wildcard-binding candidate check =====
[2026-07-09T07:22:08+00:00] Starting fixed on port 18080
[2026-07-09T07:22:10+00:00] fixed: carts.jsp did NOT render unescaped XSS payload
[2026-07-09T07:22:10+00:00] carts.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:22:12+00:00] ===== Results summary =====
[2026-07-09T07:22:12+00:00] Vulnerable 10.1.55 numguess.jsp: not_vulnerable
[2026-07-09T07:22:12+00:00] Fixed 10.1.56 numguess.jsp: not_vulnerable
[2026-07-09T07:22:12+00:00] Fixed 10.1.56 colrs.jsp candidate: not_vulnerable
[2026-07-09T07:22:12+00:00] Fixed 10.1.56 carts.jsp candidate: not_vulnerable
[2026-07-09T07:22:12+00:00] CONCLUSION: inconclusive results.
[2026-07-09T07:22:40+00:00] Java version: openjdk version "25.0.3" 2026-04-21
[2026-07-09T07:22:40+00:00] Extracting Tomcat 10.1.55
[2026-07-09T07:22:40+00:00] Extracting Tomcat 10.1.56
[2026-07-09T07:22:40+00:00] Testing original CVE-2026-50229 trigger on vulnerable 10.1.55
[2026-07-09T07:22:40+00:00] ===== vulnerable: numguess.jsp original XSS check =====
[2026-07-09T07:22:41+00:00] Starting vulnerable on port 18080
[2026-07-09T07:22:44+00:00] vulnerable is healthy
[2026-07-09T07:22:44+00:00] vulnerable: numguess.jsp unescaped XSS payload found
[2026-07-09T07:22:44+00:00] Original trigger on vulnerable: vulnerable
[2026-07-09T07:22:44+00:00] Testing original CVE-2026-50229 trigger on fixed 10.1.56
[2026-07-09T07:22:44+00:00] ===== fixed: numguess.jsp original XSS check =====
[2026-07-09T07:22:45+00:00] Starting fixed on port 18080
[2026-07-09T07:22:45+00:00] fixed is healthy
[2026-07-09T07:22:45+00:00] fixed: numguess.jsp unescaped XSS payload found
[2026-07-09T07:22:45+00:00] Original trigger on fixed: vulnerable
[2026-07-09T07:22:45+00:00] Testing candidate variant JSPs on fixed 10.1.56
[2026-07-09T07:22:45+00:00] ===== fixed: colrs.jsp wildcard-binding candidate check =====
[2026-07-09T07:22:46+00:00] Starting fixed on port 18080
[2026-07-09T07:22:46+00:00] fixed: colrs.jsp did NOT render unescaped XSS payload
[2026-07-09T07:22:46+00:00] colrs.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:22:46+00:00] ===== fixed: carts.jsp wildcard-binding candidate check =====
[2026-07-09T07:22:47+00:00] Starting fixed on port 18080
[2026-07-09T07:22:47+00:00] fixed: carts.jsp did NOT render unescaped XSS payload
[2026-07-09T07:22:47+00:00] carts.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:22:49+00:00] ===== Results summary =====
[2026-07-09T07:22:49+00:00] Vulnerable 10.1.55 numguess.jsp: vulnerable
[2026-07-09T07:22:49+00:00] Fixed 10.1.56 numguess.jsp: vulnerable
[2026-07-09T07:22:49+00:00] Fixed 10.1.56 colrs.jsp candidate: not_vulnerable
[2026-07-09T07:22:49+00:00] Fixed 10.1.56 carts.jsp candidate: not_vulnerable
[2026-07-09T07:22:49+00:00] CONCLUSION: bypass/variant reproduced on fixed 10.1.56.
[2026-07-09T07:24:22+00:00] Java version: openjdk version "25.0.3" 2026-04-21
[2026-07-09T07:24:22+00:00] Extracting Tomcat 10.1.55
[2026-07-09T07:24:23+00:00] Extracting Tomcat 10.1.56
[2026-07-09T07:24:23+00:00] Testing original CVE-2026-50229 trigger on vulnerable 10.1.55
[2026-07-09T07:24:23+00:00] ===== vulnerable: numguess.jsp original XSS check =====
[2026-07-09T07:24:27+00:00] Starting vulnerable on port 18080
[2026-07-09T07:24:29+00:00] vulnerable is healthy
[2026-07-09T07:24:29+00:00] vulnerable: numguess.jsp unescaped XSS payload found
[2026-07-09T07:24:30+00:00] Original trigger on vulnerable: vulnerable
[2026-07-09T07:24:30+00:00] Testing original CVE-2026-50229 trigger on fixed 10.1.56
[2026-07-09T07:24:30+00:00] ===== fixed: numguess.jsp original XSS check =====
[2026-07-09T07:24:34+00:00] Starting fixed on port 18080
[2026-07-09T07:24:37+00:00] fixed is healthy
[2026-07-09T07:24:37+00:00] fixed: numguess.jsp XSS payload NOT found
[2026-07-09T07:24:38+00:00] Original trigger on fixed: not_vulnerable
[2026-07-09T07:24:38+00:00] Testing candidate variant JSPs on fixed 10.1.56
[2026-07-09T07:24:38+00:00] ===== fixed: colrs.jsp wildcard-binding candidate check =====
[2026-07-09T07:24:42+00:00] Starting fixed on port 18080
[2026-07-09T07:24:45+00:00] fixed: colrs.jsp did NOT render unescaped XSS payload
[2026-07-09T07:24:46+00:00] colrs.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:24:46+00:00] ===== fixed: carts.jsp wildcard-binding candidate check =====
[2026-07-09T07:24:50+00:00] Starting fixed on port 18080
[2026-07-09T07:24:52+00:00] fixed: carts.jsp did NOT render unescaped XSS payload
[2026-07-09T07:24:53+00:00] carts.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:24:57+00:00] ===== Results summary =====
[2026-07-09T07:24:57+00:00] Vulnerable 10.1.55 numguess.jsp: vulnerable
[2026-07-09T07:24:57+00:00] Fixed 10.1.56 numguess.jsp: not_vulnerable
[2026-07-09T07:24:57+00:00] Fixed 10.1.56 colrs.jsp candidate: not_vulnerable
[2026-07-09T07:24:57+00:00] Fixed 10.1.56 carts.jsp candidate: not_vulnerable
[2026-07-09T07:24:57+00:00] CONCLUSION: original CVE is fixed; no bypass/variant found in the tested candidate JSPs.
[2026-07-09T07:25:02+00:00] Java version: openjdk version "25.0.3" 2026-04-21
[2026-07-09T07:25:02+00:00] Extracting Tomcat 10.1.55
[2026-07-09T07:25:02+00:00] Extracting Tomcat 10.1.56
[2026-07-09T07:25:02+00:00] Testing original CVE-2026-50229 trigger on vulnerable 10.1.55
[2026-07-09T07:25:02+00:00] ===== vulnerable: numguess.jsp original XSS check =====
[2026-07-09T07:25:06+00:00] Starting vulnerable on port 18080
[2026-07-09T07:25:09+00:00] vulnerable is healthy
[2026-07-09T07:25:09+00:00] vulnerable: numguess.jsp unescaped XSS payload found
[2026-07-09T07:25:10+00:00] Original trigger on vulnerable: vulnerable
[2026-07-09T07:25:10+00:00] Testing original CVE-2026-50229 trigger on fixed 10.1.56
[2026-07-09T07:25:10+00:00] ===== fixed: numguess.jsp original XSS check =====
[2026-07-09T07:25:14+00:00] Starting fixed on port 18080
[2026-07-09T07:25:17+00:00] fixed is healthy
[2026-07-09T07:25:17+00:00] fixed: numguess.jsp XSS payload NOT found
[2026-07-09T07:25:18+00:00] Original trigger on fixed: not_vulnerable
[2026-07-09T07:25:18+00:00] Testing candidate variant JSPs on fixed 10.1.56
[2026-07-09T07:25:18+00:00] ===== fixed: colrs.jsp wildcard-binding candidate check =====
[2026-07-09T07:25:22+00:00] Starting fixed on port 18080
[2026-07-09T07:25:24+00:00] fixed: colrs.jsp did NOT render unescaped XSS payload
[2026-07-09T07:25:25+00:00] colrs.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:25:25+00:00] ===== fixed: carts.jsp wildcard-binding candidate check =====
[2026-07-09T07:25:29+00:00] Starting fixed on port 18080
[2026-07-09T07:25:32+00:00] fixed: carts.jsp did NOT render unescaped XSS payload
[2026-07-09T07:25:33+00:00] carts.jsp candidate on fixed: not_vulnerable
[2026-07-09T07:25:37+00:00] ===== Results summary =====
[2026-07-09T07:25:37+00:00] Vulnerable 10.1.55 numguess.jsp: vulnerable
[2026-07-09T07:25:37+00:00] Fixed 10.1.56 numguess.jsp: not_vulnerable
[2026-07-09T07:25:37+00:00] Fixed 10.1.56 colrs.jsp candidate: not_vulnerable
[2026-07-09T07:25:37+00:00] Fixed 10.1.56 carts.jsp candidate: not_vulnerable
[2026-07-09T07:25:37+00:00] CONCLUSION: original CVE is fixed; no bypass/variant found in the tested candidate JSPs.