Demo consumer for CVE-2016-0714 (Tomcat session persistence RCE) + CVE-2013-1814 (Apache Rave UserApi info disclosure) plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/** to ROLE_ADMIN → Rave chain BROKEN. Used by EXPOSURE's configexposurescanner as the Set #2 multi-finding demo target.