📄 React / Next.js Unauthenticated Remote Code Execution

A critical unauthenticated remote code execution vulnerability exists in React Server Components RSC Flight protocol. The vulnerability allows attackers to achieve prototype pollution during deserialization of RSC payloads by sending specially crafted multipart requests with proto, constructor, o...

📄 React 19.2.0 PHP Scanner / Remote Code Execution

This project delivers a PHP-based vulnerability scanner and remote code execution exploit for CVE‑2025‑55182 affecting React Server Components. It leverages RSC serialization weaknesses to execute arbitrary commands and validate successful exploitation...

Arbitrary Code Injection

Overview @vitejs/plugin-rsc is a React Server Components RSC support for Vite. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe dynamic imports in the loadServerAction, decodeReply, and decodeAction server APIs. An attacker can execute arbitrary JavaScript...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Vulnerability Scanner A safe, non-invasive scanne...

EUVD-2025-201795

Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege...

Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)

The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing atta...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - React2Shell PoC A proof of concept exploit f...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Demonstration Lab Next.js / React RSC RCE Th...

Exploit for Deserialization of Untrusted Data in Facebook React

RSC Surface & Crash Detector This tool is a non-intrusive sec...

⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More

It's been a week of chaos in code and calm in headlines. A bug that broke the internet's favorite framework, hackers chasing AI tools, fake apps stealing cash, and record-breaking cyberattacks — all within days. If you blink, you'll miss how fast the threat map is changing. New flaws are being...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 / CVE-2025-66478 Vulnerability Replay Environme...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Security Tool CVE-2025-55182 & CVE-2025-66478...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Scanner A proof-of-concept scanner for CVE-2...

Exploit for CVE-2025-66478

CVE-2025-66478 Vulnerability Demo This repository contains a...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Vulnerability - CVE-2025-55182 :notebook: In...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - Next.js/React Server Components Remote Code E...

Exploit for Deserialization of Untrusted Data in Facebook React

Output Example 🚀 Starting the CVE-2025-55182 full acces...

Exploit for Deserialization of Untrusted Data in Facebook React

🔥React2Shell - CVE-2025-55182 / CVE-2025-66478 Proof of Concep...

CVE-2025-61318

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature...

Emlog Pro 安全漏洞

Emlog Pro is a blogging system of Emlog open source. A security vulnerability exists in Emlog Pro version 2.5.20, which stems from a lack of path validation in the admin/template.php and admin/plugin.php components, which could result in the deletion of arbitrary files...