Kill Bill

Limitations

• JVM operational footprint: The server and background workers require notable memory and monitoring, creating higher ops overhead than lightweight binaries or hosted SaaS.
• Rigid catalog schemas: Native plans require authoring XML definitions (CatalogSchema.xsd), adding friction to pricing changes unless teams write dynamic catalog plugins.
• No native tax calculations: Calculating sales tax or VAT requires integrating external services like Avalara, as the core does not embed jurisdictional rate tables.
• Complex bundle deployments: Installing plugins through the package manager demands OSGi classpath validation, while high concurrency requires tuning database locks and queue retry intervals.

Who should use it

• Operations leads managing high-volume recurring billing: Eliminates percentage platform fees and gives full control over database records, retries, and gateway routing.
• Digital agencies hosting client billing systems: Employs multi-tenancy to isolate payment credentials, catalogs, and invoices across clients on a shared cluster.
• SaaS teams with custom subscription logic: Supports non-standard billing lifecycles, complex trial structures, and account hierarchies that rigid commercial platforms reject.

FAQ

Kill Bill vs Stripe — which should an operations team choose? Stripe suits organizations seeking immediate deployment with zero infrastructure overhead. Kill Bill fits engineering teams needing multi-gateway routing, zero revenue-cut billing fees, and direct database ownership.

Is Kill Bill free for commercial use? Yes. The platform and its plugins carry no license fees or account limits, requiring only the infrastructure to host them.

What infrastructure is required to run Kill Bill? It requires a Java runtime environment, a relational database like MySQL or PostgreSQL, and compute resources to host the engine alongside the Kaui administrative UI.

Verdict

Kill Bill provides capable billing infrastructure for organizations prioritizing processor independence and data sovereignty, provided they can operate a dedicated Java environment. Its Apache-2.0 license permits royalty-free deployment without revenue cuts, and active commits through late 2026 demonstrate steady upstream maintenance. For teams facing escalating SaaS billing commissions or requiring custom billing logic, the platform repays its operational investment in cost control and architectural freedom.

Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 107 s: killbill/killbill:0.24.22, killbill/mariadb:0.24.

Based on the upstream setup. Official compose from killbill-cloud adapted for standalone server deployment. Image pinned to 0.24.22; MariaDB root password and Shiro admin password moved to .env; debug port 8000 and OSGi telnet port 12345 omitted; healthchecks added for database and server. Kaui (admin UI) is omitted as Kill Bill operates headlessly via REST API on port 8080.

gins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:30.578082420Z {"@timestamp":"2026-11-03T01:46:30.573Z","message":"31 * Server has received a request on thread catalina-exec-51\n31 > GET http://oss-verify.example/plugins/vkeyboard/vkeyboard.php?passformname=%22%3E%3Cscript%3Ealert%28680334356%29%3B%3C%2Fscript%3E%3Cscript%3E%2F%2A\n31 > accept: */*\n31 > accept-encoding: gzip\n31 > accept-language: en\n31 > host: oss-verify.example\n31 > user-agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.11\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-51","level":"INFO","req.requestURI":"/plugins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.11"}
killbill-1  | 2026-11-03T01:46:30.584762503Z {"@timestamp":"2026-11-03T01:46:30.584Z","message":"/plugins/vkeyboard/vkeyboard.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-51","level":"WARN","req.requestURI":"/plugins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.requestId":"c2956b49-9ec7-417d-8d89-9769da644403","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.11"}
killbill-1  | 2026-11-03T01:46:30.587056003Z {"@timestamp":"2026-11-03T01:46:30.586Z","message":"/plugins/vkeyboard/vkeyboard.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-65","level":"WARN","req.requestURI":"/plugins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.requestId":"f3dd1170-963d-449b-8744-fdfd24b9462b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:30.587338961Z {"@timestamp":"2026-11-03T01:46:30.585Z","message":"31 * Server responded with a response on thread catalina-exec-51\n31 < 404\n31 < Access-Control-Allow-Credentials: true\n31 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n31 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n31 < Access-Control-Allow-Origin: *\n31 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n31 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-51","level":"INFO","req.requestURI":"/plugins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.requestId":"c2956b49-9ec7-417d-8d89-9769da644403","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.11"}
killbill-1  | 2026-11-03T01:46:30.589574461Z {"@timestamp":"2026-11-03T01:46:30.587Z","message":"30 * Server responded with a response on thread catalina-exec-65\n30 < 404\n30 < Access-Control-Allow-Credentials: true\n30 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n30 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n30 < Access-Control-Allow-Origin: *\n30 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n30 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-65","level":"INFO","req.requestURI":"/plugins/vkeyboard/vkeyboard.php","req.queryString":"passformname=%22%3E%3Cscript%3Ealert(680334356)%3B%3C%2Fscript%3E%3Cscript%3E%2F*","req.requestId":"f3dd1170-963d-449b-8744-fdfd24b9462b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/vkeyboard/vkeyboard.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:35.570448214Z {"@timestamp":"2026-11-03T01:46:35.568Z","message":"32 * Server has received a request on thread catalina-exec-2\n32 > GET http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php?file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\n32 > accept: */*\n32 > accept-encoding: gzip\n32 > accept-language: en\n32 > host: oss-verify.example\n32 > user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-2","level":"INFO","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0"}
killbill-1  | 2026-11-03T01:46:35.585397339Z {"@timestamp":"2026-11-03T01:46:35.571Z","message":"33 * Server has received a request on thread catalina-exec-98\n33 > GET http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php?file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\n33 > accept: */*\n33 > accept-encoding: gzip\n33 > accept-language: en\n33 > host: oss-verify.example\n33 > user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-98","level":"INFO","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0"}
killbill-1  | 2026-11-03T01:46:35.588074922Z {"@timestamp":"2026-11-03T01:46:35.587Z","message":"/plugins/content/jw_allvideos/includes/download.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-98","level":"WARN","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.requestId":"10a4ee75-2f6e-4224-9888-c3efa6b2eb53","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0"}
killbill-1  | 2026-11-03T01:46:35.592435880Z {"@timestamp":"2026-11-03T01:46:35.591Z","message":"33 * Server responded with a response on thread catalina-exec-98\n33 < 404\n33 < Access-Control-Allow-Credentials: true\n33 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n33 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n33 < Access-Control-Allow-Origin: *\n33 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n33 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-98","level":"INFO","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.requestId":"10a4ee75-2f6e-4224-9888-c3efa6b2eb53","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0"}
killbill-1  | 2026-11-03T01:46:35.594435505Z {"@timestamp":"2026-11-03T01:46:35.589Z","message":"/plugins/content/jw_allvideos/includes/download.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-2","level":"WARN","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.requestId":"2309ba0e-3cc9-4147-b501-f485483ca20b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0"}
killbill-1  | 2026-11-03T01:46:35.595165880Z {"@timestamp":"2026-11-03T01:46:35.594Z","message":"32 * Server responded with a response on thread catalina-exec-2\n32 < 404\n32 < Access-Control-Allow-Credentials: true\n32 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n32 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n32 < Access-Control-Allow-Origin: *\n32 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n32 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-2","level":"INFO","req.requestURI":"/plugins/content/jw_allvideos/includes/download.php","req.queryString":"file=../../../../../../../../etc/passwd","req.requestId":"2309ba0e-3cc9-4147-b501-f485483ca20b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/content/jw_allvideos/includes/download.php","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0"}
killbill-1  | 2026-11-03T01:46:44.603663385Z {"@timestamp":"2026-11-03T01:46:44.602Z","message":"34 * Server has received a request on thread catalina-exec-64\n34 > GET http://oss-verify.example/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie%3A%20crlfinjection=1\n34 > accept: */*\n34 > accept-encoding: gzip\n34 > accept-language: en\n34 > host: oss-verify.example\n34 > user-agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-64","level":"INFO","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:44.605288301Z {"@timestamp":"2026-11-03T01:46:44.603Z","message":"/plugins/captcha/crypt/cryptographp.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-64","level":"WARN","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.requestId":"8c958ee4-7515-4c73-9994-334fc4bfc28f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:44.608952343Z {"@timestamp":"2026-11-03T01:46:44.606Z","message":"35 * Server has received a request on thread catalina-exec-82\n35 > GET http://oss-verify.example/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie%3A%20crlfinjection=1\n35 > accept: */*\n35 > accept-encoding: gzip\n35 > accept-language: en\n35 > host: oss-verify.example\n35 > user-agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-82","level":"INFO","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4"}
killbill-1  | 2026-11-03T01:46:44.609534635Z {"@timestamp":"2026-11-03T01:46:44.609Z","message":"/plugins/captcha/crypt/cryptographp.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-82","level":"WARN","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.requestId":"4f32bb84-a8b0-48da-90c5-84e91c49ab31","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4"}
killbill-1  | 2026-11-03T01:46:44.611274343Z {"@timestamp":"2026-11-03T01:46:44.610Z","message":"35 * Server responded with a response on thread catalina-exec-82\n35 < 404\n35 < Access-Control-Allow-Credentials: true\n35 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n35 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n35 < Access-Control-Allow-Origin: *\n35 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n35 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-82","level":"INFO","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.requestId":"4f32bb84-a8b0-48da-90c5-84e91c49ab31","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4"}
killbill-1  | 2026-11-03T01:46:44.611522426Z {"@timestamp":"2026-11-03T01:46:44.609Z","message":"34 * Server responded with a response on thread catalina-exec-64\n34 < 404\n34 < Access-Control-Allow-Credentials: true\n34 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n34 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n34 < Access-Control-Allow-Origin: *\n34 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n34 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-64","level":"INFO","req.requestURI":"/plugins/captcha/crypt/cryptographp.php","req.queryString":"cfg=1%0D%0ASet-Cookie:%20crlfinjection=1","req.requestId":"8c958ee4-7515-4c73-9994-334fc4bfc28f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/captcha/crypt/cryptographp.php","req.userAgent":"Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:47.582921386Z {"@timestamp":"2026-11-03T01:46:47.578Z","message":"37 * Server has received a request on thread catalina-exec-97\n37 > GET http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n37 > accept: */*\n37 > accept-encoding: gzip\n37 > accept-language: en\n37 > host: oss-verify.example\n37 > user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-97","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0"}
killbill-1  | 2026-11-03T01:46:47.587200094Z {"@timestamp":"2026-11-03T01:46:47.576Z","message":"36 * Server has received a request on thread catalina-exec-75\n36 > GET http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n36 > accept: */*\n36 > accept-encoding: gzip\n36 > accept-language: en\n36 > host: oss-verify.example\n36 > user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-75","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:47.588644220Z {"@timestamp":"2026-11-03T01:46:47.588Z","message":"/plugins/servlet/svnwebclient/changedResource.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-75","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"31c46636-5f42-43e1-b653-37423c941e27","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:47.589070803Z {"@timestamp":"2026-11-03T01:46:47.588Z","message":"/plugins/servlet/svnwebclient/changedResource.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-97","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"3aaf6546-bd9e-44b7-b79b-9def45aae3fe","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0"}
killbill-1  | 2026-11-03T01:46:47.589843136Z {"@timestamp":"2026-11-03T01:46:47.589Z","message":"37 * Server responded with a response on thread catalina-exec-97\n37 < 404\n37 < Access-Control-Allow-Credentials: true\n37 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n37 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n37 < Access-Control-Allow-Origin: *\n37 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n37 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-97","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"3aaf6546-bd9e-44b7-b79b-9def45aae3fe","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0"}
killbill-1  | 2026-11-03T01:46:47.594329428Z {"@timestamp":"2026-11-03T01:46:47.589Z","message":"36 * Server responded with a response on thread catalina-exec-75\n36 < 404\n36 < Access-Control-Allow-Credentials: true\n36 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n36 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n36 < Access-Control-Allow-Origin: *\n36 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n36 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-75","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/changedResource.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"31c46636-5f42-43e1-b653-37423c941e27","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/changedResource.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"}
killbill-1  | 2026-11-03T01:46:48.566196553Z {"@timestamp":"2026-11-03T01:46:48.562Z","message":"38 * Server has received a request on thread catalina-exec-28\n38 > GET http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp?%27%29%3Balert%28%22XSS\n38 > accept: */*\n38 > accept-encoding: gzip\n38 > accept-language: en\n38 > host: oss-verify.example\n38 > user-agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-28","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:48.576058970Z {"@timestamp":"2026-11-03T01:46:48.575Z","message":"/plugins/servlet/svnwebclient/commitGraph.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-28","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.requestId":"5be49cfc-4fe3-4cd1-808a-64b3998d7f1b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:48.579531303Z {"@timestamp":"2026-11-03T01:46:48.577Z","message":"39 * Server has received a request on thread catalina-exec-78\n39 > GET http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp?%27%29%3Balert%28%22XSS\n39 > accept: */*\n39 > accept-encoding: gzip\n39 > accept-language: en\n39 > host: oss-verify.example\n39 > user-agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-78","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:48.584860095Z {"@timestamp":"2026-11-03T01:46:48.584Z","message":"/plugins/servlet/svnwebclient/commitGraph.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-78","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.requestId":"8b42d553-8973-40b9-aa93-2315742baa51","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:48.588107012Z {"@timestamp":"2026-11-03T01:46:48.587Z","message":"39 * Server responded with a response on thread catalina-exec-78\n39 < 404\n39 < Access-Control-Allow-Credentials: true\n39 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n39 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n39 < Access-Control-Allow-Origin: *\n39 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n39 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-78","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.requestId":"8b42d553-8973-40b9-aa93-2315742baa51","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:48.592770345Z {"@timestamp":"2026-11-03T01:46:48.579Z","message":"38 * Server responded with a response on thread catalina-exec-28\n38 < 404\n38 < Access-Control-Allow-Credentials: true\n38 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n38 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n38 < Access-Control-Allow-Origin: *\n38 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n38 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-28","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"%27)%3Balert(%22XSS","req.requestId":"5be49cfc-4fe3-4cd1-808a-64b3998d7f1b","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:48.595370887Z {"@timestamp":"2026-11-03T01:46:48.594Z","message":"40 * Server has received a request on thread catalina-exec-66\n40 > GET http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n40 > accept: */*\n40 > accept-encoding: gzip\n40 > accept-language: en\n40 > host: oss-verify.example\n40 > user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-66","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:48.595865053Z {"@timestamp":"2026-11-03T01:46:48.595Z","message":"/plugins/servlet/svnwebclient/commitGraph.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-66","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"0ab485a9-9d1d-49e8-84b6-60f4a19f8c73","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:48.596544928Z {"@timestamp":"2026-11-03T01:46:48.595Z","message":"40 * Server responded with a response on thread catalina-exec-66\n40 < 404\n40 < Access-Control-Allow-Credentials: true\n40 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n40 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n40 < Access-Control-Allow-Origin: *\n40 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n40 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-66","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"0ab485a9-9d1d-49e8-84b6-60f4a19f8c73","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15"}
killbill-1  | 2026-11-03T01:46:49.561788804Z {"@timestamp":"2026-11-03T01:46:49.560Z","message":"41 * Server has received a request on thread catalina-exec-23\n41 > GET http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n41 > accept: */*\n41 > accept-encoding: gzip\n41 > accept-language: en\n41 > host: oss-verify.example\n41 > user-agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-23","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.564484429Z {"@timestamp":"2026-11-03T01:46:49.564Z","message":"/plugins/servlet/svnwebclient/commitGraph.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-23","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"f02cfd17-6792-4e97-b6a4-80ff08c73320","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.565166595Z {"@timestamp":"2026-11-03T01:46:49.561Z","message":"42 * Server has received a request on thread catalina-exec-74\n42 > GET http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&description=test\n42 > accept: */*\n42 > accept-encoding: gzip\n42 > accept-language: en\n42 > host: oss-verify.example\n42 > user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-74","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1"}
killbill-1  | 2026-11-03T01:46:49.567289512Z {"@timestamp":"2026-11-03T01:46:49.566Z","message":"/plugins/servlet/svnwebclient/error.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-74","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.requestId":"5f9db707-9c87-448e-b1f5-7021c8be625f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1"}
killbill-1  | 2026-11-03T01:46:49.568265845Z {"@timestamp":"2026-11-03T01:46:49.565Z","message":"41 * Server responded with a response on thread catalina-exec-23\n41 < 404\n41 < Access-Control-Allow-Credentials: true\n41 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n41 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n41 < Access-Control-Allow-Origin: *\n41 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n41 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-23","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/commitGraph.jsp","req.queryString":"url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"f02cfd17-6792-4e97-b6a4-80ff08c73320","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/commitGraph.jsp","req.userAgent":"Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.574440679Z {"@timestamp":"2026-11-03T01:46:49.569Z","message":"42 * Server responded with a response on thread catalina-exec-74\n42 < 404\n42 < Access-Control-Allow-Credentials: true\n42 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n42 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n42 < Access-Control-Allow-Origin: *\n42 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n42 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-74","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.requestId":"5f9db707-9c87-448e-b1f5-7021c8be625f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1"}
killbill-1  | 2026-11-03T01:46:49.577125345Z {"@timestamp":"2026-11-03T01:46:49.573Z","message":"43 * Server has received a request on thread catalina-exec-69\n43 > GET http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&description=test\n43 > accept: */*\n43 > accept-encoding: gzip\n43 > accept-language: en\n43 > host: oss-verify.example\n43 > user-agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.13\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-69","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.13"}
killbill-1  | 2026-11-03T01:46:49.578118720Z {"@timestamp":"2026-11-03T01:46:49.577Z","message":"/plugins/servlet/svnwebclient/error.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-69","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.requestId":"dee8d979-bda9-4501-94d6-e461914aea84","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.13"}
killbill-1  | 2026-11-03T01:46:49.579947262Z {"@timestamp":"2026-11-03T01:46:49.578Z","message":"43 * Server responded with a response on thread catalina-exec-69\n43 < 404\n43 < Access-Control-Allow-Credentials: true\n43 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n43 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n43 < Access-Control-Allow-Origin: *\n43 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n43 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-69","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/error.jsp","req.queryString":"errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test","req.requestId":"dee8d979-bda9-4501-94d6-e461914aea84","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/error.jsp","req.userAgent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.13"}
killbill-1  | 2026-11-03T01:46:49.584611762Z {"@timestamp":"2026-11-03T01:46:49.584Z","message":"44 * Server has received a request on thread catalina-exec-3\n44 > GET http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n44 > accept: */*\n44 > accept-encoding: gzip\n44 > accept-language: en\n44 > host: oss-verify.example\n44 > user-agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-3","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.585065554Z {"@timestamp":"2026-11-03T01:46:49.584Z","message":"/plugins/servlet/svnwebclient/statsItem.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-3","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"f7dd1c30-4bb0-4934-a93b-2212e469b213","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.585822387Z {"@timestamp":"2026-11-03T01:46:49.585Z","message":"44 * Server responded with a response on thread catalina-exec-3\n44 < 404\n44 < Access-Control-Allow-Credentials: true\n44 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n44 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n44 < Access-Control-Allow-Origin: *\n44 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n44 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-3","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"f7dd1c30-4bb0-4934-a93b-2212e469b213","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.589063220Z {"@timestamp":"2026-11-03T01:46:49.588Z","message":"45 * Server has received a request on thread catalina-exec-23\n45 > GET http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n45 > accept: */*\n45 > accept-encoding: gzip\n45 > accept-language: en\n45 > host: oss-verify.example\n45 > user-agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-23","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.589470679Z {"@timestamp":"2026-11-03T01:46:49.589Z","message":"/plugins/servlet/svnwebclient/statsItem.jsp responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-23","level":"WARN","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"3ea479f0-8ff5-4b14-a4ba-5061412a0621","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:49.590472179Z {"@timestamp":"2026-11-03T01:46:49.589Z","message":"45 * Server responded with a response on thread catalina-exec-23\n45 < 404\n45 < Access-Control-Allow-Credentials: true\n45 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n45 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n45 < Access-Control-Allow-Origin: *\n45 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n45 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-23","level":"INFO","req.requestURI":"/plugins/servlet/svnwebclient/statsItem.jsp","req.queryString":"url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E","req.requestId":"3ea479f0-8ff5-4b14-a4ba-5061412a0621","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/servlet/svnwebclient/statsItem.jsp","req.userAgent":"Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
killbill-1  | 2026-11-03T01:46:51.564496971Z {"@timestamp":"2026-11-03T01:46:51.563Z","message":"46 * Server has received a request on thread catalina-exec-92\n46 > GET http://oss-verify.example/plugins/wordpress_sso/pages/index.php?wordpress_user=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\n46 > accept: */*\n46 > accept-encoding: gzip\n46 > accept-language: en\n46 > host: oss-verify.example\n46 > user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-92","level":"INFO","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"}
killbill-1  | 2026-11-03T01:46:51.565991638Z {"@timestamp":"2026-11-03T01:46:51.565Z","message":"/plugins/wordpress_sso/pages/index.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-92","level":"WARN","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.requestId":"e920884c-47c0-4e33-a72e-3fe1154876ff","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"}
killbill-1  | 2026-11-03T01:46:51.569762013Z {"@timestamp":"2026-11-03T01:46:51.568Z","message":"47 * Server has received a request on thread catalina-exec-91\n47 > GET http://oss-verify.example/plugins/wordpress_sso/pages/index.php?wordpress_user=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\n47 > accept: */*\n47 > accept-encoding: gzip\n47 > accept-language: en\n47 > host: oss-verify.example\n47 > user-agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-91","level":"INFO","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0"}
killbill-1  | 2026-11-03T01:46:51.572194763Z {"@timestamp":"2026-11-03T01:46:51.571Z","message":"/plugins/wordpress_sso/pages/index.php responded 404","logger_name":"org.killbill.billing.jaxrs.resources.PluginResource","thread_name":"catalina-exec-91","level":"WARN","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.requestId":"ae5670ad-5576-4925-8e95-536de305318f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0"}
killbill-1  | 2026-11-03T01:46:51.574038555Z {"@timestamp":"2026-11-03T01:46:51.572Z","message":"47 * Server responded with a response on thread catalina-exec-91\n47 < 404\n47 < Access-Control-Allow-Credentials: true\n47 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n47 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n47 < Access-Control-Allow-Origin: *\n47 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n47 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-91","level":"INFO","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.requestId":"ae5670ad-5576-4925-8e95-536de305318f","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0"}
killbill-1  | 2026-11-03T01:46:51.579468805Z {"@timestamp":"2026-11-03T01:46:51.576Z","message":"46 * Server responded with a response on thread catalina-exec-92\n46 < 404\n46 < Access-Control-Allow-Credentials: true\n46 < Access-Control-Allow-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n46 < Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS\n46 < Access-Control-Allow-Origin: *\n46 < Access-Control-Expose-Headers: Authorization,Content-Type,Location,X-Killbill-ApiKey,X-Killbill-ApiSecret,X-Killbill-Comment,X-Killbill-CreatedBy,X-Killbill-Pagination-CurrentOffset,X-Killbill-Pagination-MaxNbRecords,X-Killbill-Pagination-NextOffset,X-Killbill-Pagination-NextPageUri,X-Killbill-Pagination-TotalNbRecords,X-Killbill-Reason\n46 < Content-Type: application/octet-stream\n","logger_name":"org.glassfish.jersey.logging.LoggingFeature","thread_name":"catalina-exec-92","level":"INFO","req.requestURI":"/plugins/wordpress_sso/pages/index.php","req.queryString":"wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E","req.requestId":"e920884c-47c0-4e33-a72e-3fe1154876ff","req.method":"GET","req.remoteHost":"192.168.65.70","req.requestURL":"http://oss-verify.example/plugins/wordpress_sso/pages/index.php","req.userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"}