BadParcel

BadParcel Vedi Bundle Fengshui per un'analisi approfondita di questa classe di bug. Questa repository contiene il PoC per CVE-2023-20963, che riguarda una discrepanza nella logica parcel/unparcel di Android WorkSource. La vulnerabilità è stata corretta nel bollettino sulla sicurezza Android di...

CVE-2015-1474_poc

Questo codice è inteso come un tentativo di PoC per CVE-2015-1474. Il codice è basato sul codice del comando screencap, ma genera un parcel dannoso che causa il crash del surfaceflinger quando viene deserializzato. Vedi maggiori informazioni su...

LeakValue

Android 13 introduce numerose migliorie per indurire il meccanismo di serializzazione di Parcel Ecco la presentazione del team Android Security and Privacy sulle migliorie apportate È fantastico, sicuramente elimina o rende non sfruttabili molte vulnerabilità. Inoltre descrivono come hanno...

ResourcePoison

La correzione per questo problema è apparsa come CVE-2025-22441: bollettino patch follow up Passare ApplicationInfo in giro ApplicationInfo è una struttura che definisce varie informazioni sull'app installata, in particolare il percorso del file apk da cui vengono caricati risorse e codice Di...

ReparcelBug2

CVE-2021-0928, incompatibilidade de serialização writeToParcel/createFromParcel em android.hardware.camera2.params.OutputConfiguration Este é um exploit que usa essa vulnerabilidade para escalonamento de privilégios de um app Android instalado para o app de Configurações do Android ou qualquer...

-CVE-2025-55182

🔍 GitHub CVE Scanner - Guide d'utilisation Script pour analyser les dépôts GitHub à la recherche de vulnérabilités connues dans les projets React et Next.js. 📋 Vulnérabilités détectées Le scanner vérifie les CVE suivantes : CVE-2025-55182 : Vulnérabilité dans React Server Components Concerne :...

Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

Next.js RSC RCE Scanner Extensão para Burp Suite Uma extensão de alta fidelidade para Burp Suite que detecta a vulnerabilidade de Execução Remota de Código RCE no Next.js / React Server Components RSC CVE-2025-55182 e CVE-2025-66478. Esta extensão implementa a lógica de detecção descoberta pela...

CVE-2017-13286

CVE-2017-13286 CVE-2017-13286 PoC нельзя использовать Все ресурсы взяты из этой статьи https://bbs.kanxue.com/thread-268506.htm Основной причиной этой уязвимости является несоответствие чтения и записи объекта Parcel, что можно проследить до следующего кода: root@kitploit: public void...

ThisSeemsWrong

Fix for this issue appeared as CVE-2024-49746: bulletin, patch "Questo sembra sbagliato" Il titolo sopra è il commento dal metodo Parcel::continueWrite, che in realtà è responsabile del ridimensionamento degli oggetti Parcel, sia quando esplicitamente richiesto dall'utente ad esempio tramite...

ReparcelBug

Android-PoC für den writeToParcel/createFromParcel-Mismatch-Bug Siehe https://github.com/michalbednarski/IntentsLab/issues/2issuecomment-344365482 für eine Beschreibung des Bugs. Dieses Repository enthält den PoC für CVE-2017-0806, bei dem es sich um einen Mismatch in der GateKeeperResponse-Klass...

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

The vulnerability CVE-2026-44907 is a Denial of Service affecting React server-side rendering components. An attacker can trigger high CPU usage by sending specially crafted HTTP requests to server function endpoints in affected packages: react-server-dom-webpack, react-server-dom-parcel, and rea...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

EUVD-2026-39188

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702 InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702

The CVE concerns the InPost PL WordPress plugin (before 1.9.1) failing to verify that a request to update the WooCommerce order parcel-locker destination originates from the legitimate buyer. This allows unauthenticated attackers to silently redirect the shipping destination of any pending or pro...

CVE-2026-9607

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...