Exploit for CVE-2025-55182

Affect Version |组件|复现推荐使用版本|易受攻击版本范围| |--|--|--| |Node.js...

Vulnerabilities fixed in React Server Components

React has fixed vulnerabilities in certain versions of React Server Components specifically for versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0. An unauthenticated attacker can send a rogue HTTP request to any Server Function endpoint that, when processed by React, can lead to remote code execution on...

Security Bulletin: Security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Standard.

Summary Security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Standard. IBM WebSphere Liberty has been updated within IBM CICS TX Standard to address these vulnerabilities. Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before...

Exploit for CVE-2025-55182

Next.js React Server Components RCE Exploit Exploits CVE-2025...

Exploit for CVE-2025-55182

React2Shell Scanner High Fidelity Detection & Exploitation To...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit v2.0 A c...

Exploit for CVE-2025-55182

CVE-2025-55182 - React RSC RCE PoC pour la vuln de deserialis...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:azure__msal-node (1.5.0) +7 more potentially affected by CVE-2025-65945 via org.webjars.npm:jws (>=3.2.2, <=4.0.0)

org.webjars.npm:jws MAVEN version =3.2.2, =1.6.1, =2.3.2, =5.5.4, =0.0.1, =1.0.0 Source cves: CVE-2025-65945 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14188254...

Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows

On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution RCE vulnerability in React Server Components RSC, tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across...

Exploit for CVE-2025-55182

what's it For CVE-2025-55182 and CVE-2025-66478 Security Resp...

Exploit for CVE-2025-55182

CVE-2025-55182 and CVE-2025-66478 Technical Analysis of Ar...

com.sksamuel.scruffy:scruffy-integrationtest_2.11 (1.12.0), com.sksamuel.scruffy:scruffy-undertow_2.11 (>=1.9.0, <=1.12.0) +39 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.2.0.beta10)

io.undertow:undertow-core MAVEN version 1.2.0.beta10 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.11 1.12.0 - com.sksamuel.scruffy:scruffy-undertow2.11...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit Python C...

@amazeelabs/bridge-waku (>=1.1.9, <=2.0.1), @amazeelabs/executors (>=3.1.12, <=3.1.14) +8 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0)

react-server-dom-webpack NPM version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.9, =3.1.12, =1.4.7, =1.1.3, =0.0.0-next-20250108080920, =0.0.0-next-20250108080920,...

DRUPAL-CONTRIB-2025-122

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

A maximum-severity security flaw has been disclosed in React Server Components RSC that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by CVE-2025-55182 +1 more via next (>=15.4.0-canary.17, <=15.4.7)

next NPM version =15.4.0-canary.17, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.0.0-dev-20250910232631, =0.1.7, =0.1.8 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

Arbitrary Code Injection

Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization of RSC payloads from HTTP requests to Server Function endpoints. An unauthenticated attacker can execute arbitrary code ...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +129 more potentially affected by CVE-2025-55182 via @modern-js/utils (>=2.65.2, <=2.69.2)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =1.0.1, =0.30.0, =0.3.0-alpha.1, =0.4.3, =1.3.0, =2.0.0 and more Source cves: CVE-2025-55182 Source advisory: SNYK:JS-MODERNJSUTILS-14723360...

Flowise JS Injection RCE

Exploits CVE-2025-59528 - JavaScript code injection in customMCP endpoint allowing remote code execution !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import re class ModuleExploit, Httpclient: info = "name":...