CVE-2017-13286

CVE-2017-13286 CVE-2017-13286 Poccannot use All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code public void...

ResourcePoison

Fix for this issue has appeared as CVE-2025-22441: bulletin patch follow up Passing ApplicationInfo around ApplicationInfo is structure defining various information about installed app, most notably path to apk file from which resources and code are loaded Usually it is passed from system to...

ReparcelBug

Android writeToParcel/createFromParcel mismatch bug PoC See https://github.com/michalbednarski/IntentsLab/issues/2issuecomment-344365482 for description of bug. This repositiory contains PoC for CVE-2017-0806, which is mismatch in GateKeeperResponse class...

ThisSeemsWrong

Fix for this issue appeared as CVE-2024-49746: bulletin, patch "This seems wrong" Above title is the comment from Parcel::continueWrite method, which is actually responsible for resizing Parcel objects, either when explicitly request by user for example through setDataSize or when calling one of...

CVE-2015-1474_poc

This code is ment to be a tentative of a poc for CVE-2015-1474. The code is based on the code of the screencap comand, but generates a rogue parcel that crashes the surfaceflinger when it is deserialized. See more at...

LeakValue

Android 13 introduces many enhancements in order to harden Parcel serialization mechanism Here's presentation from Android Security and Privacy team on enhancements made That is great, definitely eliminates or makes unexploitable many vulnerabilities. Also they describe breaking my previous...

ReparcelBug2

CVE-2021-0928, writeToParcel/createFromParcel serialization mismatch in android.hardware.camera2.params.OutputConfiguration This is exploit using that vulnerability for privilege escalation from installed Android app into Android Settings app or any other app installed app could send to declared ...

BadParcel

BadParcel See Bundle Fengshui for a deep dive on this bug class. This repository contains PoC for CVE-2023-20963, which is mismatch in the Android WorkSource parcel/unparcel logic. The vulnerability is patched on Android's Security Bulletin of March 2023. The exploit should work on devices on AOS...

-CVE-2025-55182

🔍 GitHub CVE Scanner - Usage Guide Script to scan GitHub repositories for known vulnerabilities in React and Next.js projects. 📋 Detected Vulnerabilities The scanner checks the following CVEs: CVE-2025-55182 : Vulnerability in React Server Components Affects: React 19.0.0, 19.1.0, 19.1.1, 19.2.0...

Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

Next.js RSC RCE Scanner Burp Suite Extension A high-fidelity Burp Suite extension to detect the Next.js / React Server Components RSC Remote Code Execution vulnerability CVE-2025-55182 & CVE-2025-66478. This extension implements the detection logic discovered by the Searchlight Cyber Security...

CLSA-2026-1792251863 TuxCare security update for react-server-dom-parcel (4 CVEs)

TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

CLSA-2026-1792251862 TuxCare security update for react-server-dom-parcel (1 CVE)

TuxCare rebuilt react-server-dom-parcel to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

PT-2026-127086

TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

PT-2026-127085

TuxCare rebuilt react-server-dom-parcel to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

react2shell-scanner

react2shell-scanner Triage scanner for CVE-2025-55182 R...

Exploit for Improper Authorization in Vercel Next.Js

React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...

CVE-2026-93580

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

Malicious code in kaus-auth-hermes-parcel (npm)

The package kaus-auth-hermes-parcel was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in karma-spectron-parcel-aether (npm)

Source: amazon-inspector ca8ebfffe8a310711076f2d7bdc505e17c208634ea3a5ea03c8ebecf21c0544f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...