React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: वह Deserialization बग जिसने Web को तोड़ दिया ⚡ React2Shell, CVE-2025-55182, RCE भेद्यता: React Server Components में असुरक्षित deserialization दोष का एक गंभीर विश्लेषण जो डिफ़ॉल्ट React/Next.js सेटअपों में अप्रमाणित रिमोट कोड निष्पादन को सक्षम बनाता है। ⏩ TL;DR...

CVE-2025-55182

ماسح ومستغل CVE-2025-55182 !Warning هذا المستودع مخصص لأغراض تعليمية وبحثية فقط. استخدم أدوات الإثبات المقدمة حصريًا على أنظمتك أو التي لديك إذن صريح لاختبارها. الوصول غير المصرح به أو الاستغلال أو سوء استخدام أي مادة في هذا المستودع غير قانوني. المؤلف المؤلفون لا يتحملون أي مسؤولية عن أي أضرار أ...

CVE-2026-82597

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-82598

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose...

CVE-2026-82599

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599

SeaCMS versions up to 13.6 are affected by a path traversal vulnerability in the Avatar Upload component. The flaw resides in the unlink function of /member.php?action=chgpwdsubmit, where manipulation of the oldpic argument allows a remote attacker with low privileges to delete arbitrary files. T...

EUVD-2026-68302

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

EUVD-2026-68300

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83951

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

CVE-2026-51733

An incorrect access control flaw in the FirmwareUpgrade function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated CVSS 9.8 (CR...

CVE-2026-51736

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the clearSyslog function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. Because no authentication is required, a network-based attacker can erase system logs , destroying evidence of pr...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82587

CVE-2026-82587 affects Open5GS versions up to 2.7.7 , specifically the AMF component in the file src/amf/namf-handler.c. The vulnerable function is amf_namf_comm_decode_ue_mm_context_list , where manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption . The a...

CVE-2020-17456

विवरण 21 अगस्त 2020 को, seown SLC 130 राउटर में एक प्रमाणीकरण RCE कमजोरी उजागर हुई थी। कमजोरी संख्या cve-2020-17456 है। यह कमजोरी राउटर की वेब सेवा निदान फ़ंक्शन में ping कमांड इंजेक्शन के कारण है। हार्ड कोडित क्रेडेंशियल्स के कई समूहों के साथ मिलकर, अनधिकृत हमलावर प्रमाणीकरण को बायपास कर सकते है...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

SleepyCrypt

SleepyCrypt دالة shellcode لتشفير صورة عملية جارية في الذاكرة أثناء السكون. هذا هو الكود المصاحب لمقالة مدونتي هنا. البناء ما عليك سوى تشغيل build.sh لتجميع كود C، واستخراج قسم .text كـ shellcode، وتجميعه في ملف ثنائي اختباري باسم sleep.exe. سيتطلب ذلك MinGW x8664-w64-mingw32-gcc...

ed25519-unsafe-libs

ed25519-unsafe-libs هجوم Oracle على دالة التوقيع بمفتاح عام مزدوج على Ed25519 قائمة بمكتبات توقيع ed25519 غير الآمنة احتماليًا والتي توفّر واجهة برمجة تطبيقات عامة يمكن من خلالها تمرير المفتاح السري والمفتاح العام بشكل مستقل كمدخلات لدالة التوقيع. يمكن أن يؤدي سوء استخدام هذه الواجهات العامة إلى...