-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +297 more potentially affected by CVE-2025-55183 +1 more via next (>=15.3.0, <=15.3.6)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +304 more potentially affected by CVE-2025-55183 +1 more via next (>=15.1.0, <=15.1.9)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +194 more potentially affected by CVE-2025-55183 +1 more via next (>=15.5.0, <=15.5.7)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +149 more potentially affected by CVE-2025-55183 +1 more via next (>=16.0.0, <=16.0.8)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.19 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by CVE-2025-55183 +1 more via next (>=15.4.0-canary.17, <=15.4.8)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.5.0 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +249 more potentially affected by CVE-2025-55183 +1 more via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +211 more potentially affected by CVE-2025-55183 +1 more via next (>=15.2.0, <=15.2.6)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55183, CVE-2025-551...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview next is a react framework. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere. An attacker can access the source code of any Server Function by sending a malicious HTTP request to a vulnerable Server Function...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.js React Server Components RCE Exploit Exploits CVE-2025...

CVE-2025-55183 and CVE-2025-55184: Mitigating React/Next.js Vulnerabilities

...

React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components

On December 3, 2025, a critical remote code execution RCE vulnerability, dubbed "React2Shell," was disclosed, impacting React Server Components and frameworks like Next.js. The flaw, CVE-2025-55182, could lead to full server takeover and is rated CVSS 10.0. It is under active exploitation, has be...

CVE-2025-67502

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without an...

EUVD-2025-202631

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 A simp...

Exploit for Deserialization of Untrusted Data in Facebook React

This is a Next.js project bootstrapped wit...

Exploit for Deserialization of Untrusted Data in Facebook React

💥 React2Shell-POC 💥 !pythonhttps://img.shields.io/badge/py...

CVE-2025-63054

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.2...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Checker A portable Bash script to detect vulne...

CVE-2025-67502: URL Redirection to Untrusted Site

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without an...

CVE-2025-67502

CVE-2025-67502 affects Taguette, an open source qualitative research tool. Technical details across connected sources show an open redirect in versions 1.5.1 and earlier, where a user-controlled “next” parameter in login or cookies redirects is used without validation. This allows an attacker to ...