CVE-2025-55182

CVE-2025-55182: React2Shell - Next.js Remote Code Execution Toolkit !WARNING This tool is provided for authorized testing and educational purposes only. Unauthorized network access and data exfiltration are illegal. Users are responsible for ensuring they have proper authorization before using th...

foreman: SSTI and insecure deserialization in foreman-rake configuration

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side...

foreman: SSTI and insecure deserialization in foreman-rake configuration

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side...

foreman: SSTI and insecure deserialization in foreman-rake configuration

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side...

Unihackers---CVE-2025-55182-

PANDILLA ITALIANA React2Shell PoC Este repositorio proporciona un entorno mínimo intencionalmente vulnerable para probar escáneres de seguridad contra la reciente vulnerabilidad crítica RCE React2Shell que afecta a React Server Components y Next.js. CVE-2025-55182 : Existe una vulnerabilidad de...

EXPLOIT-CVE-2025-55182

CVE-2025-55182 Prueba de Concepto Resumen Una demostración práctica de CVE-2025-55182 React2Shell - una vulnerabilidad crítica de RCE en React Server Components. Detalles de la Vulnerabilidad CVE ID : CVE-2025-55182 Tipo : Ejecución Remota de Código mediante Contaminación de Prototipos Prototype...

CVE-2025-55182_liyon

CVE-2025-55182 - RCE en Componentes del Servidor de React ⚠️ Aviso legal : Esta herramienta es solo para fines de investigación de seguridad, pruebas de penetración autorizadas y educación. Usar esta herramienta contra sistemas objetivo sin permiso explícito es ilegal y poco ético. 📋 Resumen...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

ysonet

YSoNet generates .NET deserialization payloads for authorized security research, with an interactive wizard and a command line for repeatable work. Interactive configuration: choose a gadget or plugin, get help for each setting, and copy the equivalent command. Searchable discovery: filter gadget...

CVE-2026-25769

🚨 CVE-2026-25769 - Deserialización Insegura RCE en Wazuh Ejecución Remota de Código Crítica de Worker a Master en Modo Clúster de Wazuh La deserialización insegura en las comunicaciones del clúster de Wazuh permite que un nodo worker comprometido logre RCE como root en el nodo master. 📌 Resumen I...

JDSer-ngng

JDSer-ngng A Burp Extender plugin, that will deserialized java objects and encode them in XML using the Xtream library. Why? This release fixes the bug in the other implementation in JDSer-ng which didn't actually allow modification of the request. Also extends it further, allowing proper use of...

WCFDSer-ngng

WCFDSer-ngng A Burp Extender plugin, that will make binary soap objects readable and modifiable. Based on the original work of Brian Holyfield, all hail Brian http://blog.gdssecurity.com/labs/2009/11/19/wcf-binary-soap-plug-in-for-burp.html Why? This release fixes a bug where serialization wasn't...

GuardModel

GuardModel Bloquea modelos de IA maliciosos en tu pipeline con una línea de YAML. GuardModel es una GitHub Action que escanea automáticamente archivos de modelos de ML en busca de código malicioso, vulnerabilidades y riesgos de seguridad en pipelines CI/CD. Bloquea modelos peligrosos antes de que...

Dubbo-deserialization

Dubbo-deserialization CVE-2020-1948 Apache Dubbo Provider default deserialization cause RCE Dubbo Study Dubbo-exp Dubbo-poc Dubbo复现环境...

cve-2026-59827-metabase-cyber-range

CVE-2026-59827 — Metabase / H2 Unsafe Deserialization Cyber Range Educational laboratory modeling CVE-2026-59827 GHSA-w95f-x9v9-wv36: unsafe deserialization of H2 query result columns of type OTHER in Metabase. TRAINING ONLY — DO NOT EXPOSE TO THE INTERNET Quick start git clone...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor Context Authentication Bypass — Vulnerability Detection Script A safe, unauthenticated vulnerability check for CVE-2026-19490 , the pre-authentication authentication bypass in the Citrix NetScaler ADC / NetScaler Gateway SAML service-provider path CTX696939, publishe...

CVE-2025-55182-poc

CVE-2025-55182-poc A proof-of-concept PoC exploit for CVE-2025-55182 , targeting an unauthenticated Remote Code Execution RCE vulnerability in Next.js Server Actions. This exploit abuses prototype pollution during the deserialization of React Server Components RSC multipart payloads to inject...

VulnerableGWTApp

Vulnerable GWT Web Application This is a version of the StockWatcher example application described in the GWT getting-started guide that has been modified to use the GWT "enhanced classes" feature, making it vulnerable to a Java deserialization attack. It should only be used for testing detection...

GadgetProbe

Описание Вы только что обнаружили уязвимость десериализации Java, запустили все свои эксплойты ysoserial... и не получили ничего. Что дальше? Как вы можете отлаживать или строить цепочку гаджетов, если вы совершенно слепы? Представляем GadgetProbe — инструмент, который проливает свет на удалённые...

CVE-2018-20062

CVE-2018-20062 ThinkPHP 5.0.23 - CVE-2018-20062 Impact Verification Affected Versions ThinkPHP 5.0.x 5.0.23 invokefunction deserialization Verification Methodology Standard impact assessment for this CVE follows a two-phase approach: 1. Existence check — confirm the invokefunction route is...