CVE-2025-7783-poc

form-data boundary randomness vulnerability CVE-2025-7783 Largely based on https://hackerone.com/reports/2913312 by https://hackerone.com/parrot409?type=user Installing: npm install Make sure you have python3 installed with the z3 module pip3 install -r requirements.txt -- the exploit code shells...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

ghauri

Like Ghauri, consider supporting the developer...

wordpress-jetpack-broken-access-control-exploit

wordpress-jetpack-broken-access-control-exploit This is a Python3 program that exploits Jetpack 13.9.1 broken access control vulnerability CVE-2024-9926. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool responsibly. I do not...

CVE-2025-55182-NextJS-RCE-PoC

Entorno de Reproducción CVE-2025-55182 React2Shell ⚠️ SOLO CON FINES EDUCATIVOS Este repositorio se crea estrictamente con fines educativos y de investigación. Demuestra una vulnerabilidad crítica en los Componentes del Servidor React Next.js para ayudar a los desarrolladores a comprender los...

CVE-2026-32488

CVE-2026-32488 CVE-2026-32488 Almacenar el valor del nonce en una variable $NONCE = "c82a4f80ba" curl.exe -s -X POST "http://localhost/wp-admin/admin-ajax.php" -d "action=userregistrationuserformsubmit" -d "urfrontendformnonce=$NONCE" -d "formid=6" -d...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...

EUVD-2026-77679

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

CVE-2025-55182-React2Shell-Async-Scanner

⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Escáner de RCE Asíncrono Envenenamiento de prototipos → Ejecución Remota de Código a través de React Server Actions...

CVE-2025-55182-EXP

CVE-2025-55182 Exploitation Tool Tool Introduction This tool is used to detect and exploit the CVE-2025-55182 vulnerability presumably a code execution vulnerability in frameworks related to Next.js. It supports single-target / multi-target batch detection, command execution, interactive shell, a...

cve-2025-55182

CVE-2025-55182 aka React2Shell Setup test enviornment root@kitploit: kiot :: /react2shell » docker compose build --no-cache kiot :: /react2shell » docker compose up POC Payload 1. RCE with response in body root@kitploit: POST / HTTP/1.1 Host: localhost:3000 Next-Action: whatever Content-Type:...

-CVE-2021-44790

CVE-2021-44790 Descripción de CVE-2021-44790 CVE-2021-44790 describe un fallo de seguridad a nivel de sistema en modlua de Apache HTTP Server, especialmente en la versión 2.4.51 y versiones anteriores. Esta vulnerabilidad se activa cuando la función r:parsebody procesa incorrectamente las...

CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

React2Shell

React2Shell – Advanced Discovery & Exploitation Framework An advanced React Server Components RSC vulnerability scanner and exploiter for CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications. This tool expands upon the original React2Shell research and proof-of-concept by introducing...

react2shell-cve-2025-55182

🚨 React2Shell - CVE-2025-55182 Exploitation Framework Advanced exploitation framework for CVE-2025-55182 Next.js Remote Code Execution Author: opsecramdan 📚 Table of Contents Overview Vulnerability Details Features Requirements Installation Usage Interactive Shell Output Files Impact Mitigation...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

CVE-2017-5638

LAB 1 — Inyección OGNL en Apache Struts2 CVE-2017-5638 / S2-045 I. ANÁLISIS DEL SISTEMA Análisis de la superficie de ataque Después de iniciar el contenedor, los registros de Struts2 muestran que la aplicación carga archivos de configuración conocidos como struts-default.xml , struts-plugin.xml y...

cve-2025-55182

CVE-2025-55182 Python Exploit Python 3 script that can be used to demonstrate CVE-2025-55182. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing remote code execution via malformed multipart form data. ⚠️ For educational and authorized testing...