CVE-2025-55182-exploit

⚠️ 면책 조항 이 도구는 승인된 보안 테스트 및 교육 목적으로만 사용해야 합니다. 소유한 시스템 또는 명시적인 서면 허가를 받은 시스템만 테스트하십시오. 무단 사용은 불법적이며 비윤리적입니다. 개발자는 오용에 대한 책임을 지지 않습니다. 책임감 있게 사용하고 모든 관련 법률을 준수하십시오. 🔍 개요 CVE-2025-55182는 experimental-form 기능을 사용하는 React/NextJS 애플리케이션에서 발생하는 치명적인 SSRFServer-Side Request Forgery 및 RCERemote Code...

nextploiter

nextploiter Outil d'exploitation pour NextJS Utilisation Commandes Utilisation root@kitploit: $ npm install -g nextploiter $ nextploiter COMMAND running command... $ nextploiter --version nextploiter/1.0.0 darwin-arm64 node-v24.12.0 $ nextploiter --help COMMAND USAGE $ nextploiter COMMAND...

check-cve-2025-66478

Проверка на CVE-2025-66478 Проверяет, уязвим ли ваш сервер NextJS к CVE-2025-66478. Это всего лишь быстрая и неаккуратная обёртка для HTTP-запроса, предоставленного Searchlight. Полагаясь на этот скрипт, вы предполагаете, что их исследование является достоверным индикатором уязвимости...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted 'x-middleware-subrequest' header, which can lead to authorization bypass and other securit...

Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

test-cve-2025-29927

CVE-2025-29927을 악용하기 위한 테스트 앱 이 NextJS 앱은 쿠키 기반 인증을 사용하며 /admin 페이지에 대한 무단 액세스를 방지하는 미들웨어를 포함합니다. 앱을 시작하려면 다음을 실행하세요. root@kitploit: yarn then yarn dev CVE-2025-29927 취약점을 이용하여 /admin 페이지에 대한 무단 액세스를 얻으려면 요청에 특수 헤더를 추가하는 프록시 서버를 실행하세요. root@kitploit: node scripts/proxy.js 그런 다음...

next-cve-2025-66478

NextJS CVE-2025-66478 Scanne tous les projets vulnérables à CVE-2025-66478 dans le répertoire de travail actuel et les signale. En savoir plus sur CVE-2025-66478 Avertissement Ce script ne corrige aucune vulnérabilité. Il sert uniquement à les localiser. Veuillez vous référer à cet article pour e...

ROOT-APP-NPM-CVE-2025-55173 CVE-2025-55173 in next - Patched by Root

Root has patched CVE-2025-55173 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-57752 CVE-2025-57752 in next - Patched by Root

Root has patched CVE-2025-57752 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-57822 CVE-2025-57822 in next - Patched by Root

Root has patched CVE-2025-57822 in the next package for Root:npm. Multiple fixed versions available...

Exploit for Deserialization of Untrusted Data in Facebook React

Docker Lab & PoC Validation: React2Shell CVE-2025-55182...

Linux Distros Unpatched Vulnerability : CVE-2026-64642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using...

Linux Distros Unpatched Vulnerability : CVE-2026-64641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting...

Linux Distros Unpatched Vulnerability : CVE-2026-64644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js...

CVE-2026-64647

A flaw was found in Next.js. This vulnerability allows a remote attacker to potentially access confidential data. When a server-side fetch processes a request with a body using a non-UTF-8 character set, it may incorrectly return a cached response body from a different request to the same URL but...

CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

CVE-2026-64641

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-64643

CVE-2026-64643 affects Next.js (versions 12.0.0–15.5.20 and 16.0.0–16.2.10) where apps using App Router, Server Actions (use server) or cache endpoints can disclose internal Server Action IDs and endpoints to unauthenticated users via publicly served client artifacts. This disclosure allows unaut...