CVE-2025-55182

CVE-2025-55182 Scanner & Exploit Lab This repository contains a comprehensive scanner and exploit tool for CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components RSC. It also includes a realistic "Lab Environment" to safely test and understand the...

React2ShellPoC

Understanding CVE-2025-55182 React2Shell: A Deep Dive into Remote Code Execution via React Server Components Overview CVE-2025-55182, also known as React2Shell , is a critical remote code execution RCE vulnerability affecting React Server Components. This flaw enables unauthenticated attackers to...

CVE-2025-55182-Terminal

Next.js RSC Vulnerability Scanner CVE-2025-66478 / CVE-2025-55182 A lightweight, multi-threaded Proof of Concept PoC tool designed to detect and demonstrate the Next.js React Server Components RSC Remote Code Execution vulnerability React2Shell. This tool allows for both single-target verificatio...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used vulnerability discovered by ? in WordPress npm next versions = 10.0.0, = 15.5.27...

CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass An advanced, highly reliable Proof of Concept PoC exploit for CVE-2024-27348 Remote Code Execution in Apache HugeGraph Server. Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Testeur CVE-2026-109618 / CVE-2026-109619 php2shell Un scri...

php2shell-CVE-2026-109618-CVE-2026-109619-PoC

php2shell — CVE-2026-109618 / CVE-2026-109619 Critical Advisory CVSS v4.0: 9.2 - Critical: On October 20, details of two pre-auth Remote Code Execution RCE flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web...

CVE-2025-69516

CVE-2025-69516 - Tactical RMM Remote Code Execution This repository contains a Python script that automates the exploitation of the CVE-2025-69516 SSTI vulnerability in Tactical RMM. It has been tested on version 1.3.1. Usage python xpl.py -d api.tactical.xyz -t SESSIONTOKEN -c "id" Links...

magnus_billing_7.3.0_RCE_CVE-2023-30258

magnusbilling7.3.0RCECVE-2023-30258 There is a remote code execution vulnerability in magnus billing 7.3.0, in the parameter "democ" from the "icepay.php" resource, where you can escape the query and execute the command you want. VULNERABLE CODE if isset$GET'democ' if strlen$GET'democ' 5 exec"tou...

CVE-2025-49132-Pterodactyl-Panel-RCE

CVE-2025-49132 — Pterodactyl Panel Security Research & Educational Analysis Overview This project documents research related to CVE-2025-49132 , a vulnerability affecting the Pterodactyl Panel. Purpose: Security research, education, defensive awareness Use only in controlled environments Does not...

POC-CVE-2026-0769

Description Proof of concept exploit code for CVE-2026-0769 Usage python3 poc.py -u -c Without bash command proof of code exec via Divide By Zero Error With bash command NOTE: Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stor...

tech-seminar-React2Shell

React2Shell CVE-2025-55182 Woori FISA Technical Seminar 6th - Team 3: Analysis and research on React2Shell, a remote code execution RCE vulnerability exploiting design flaws in React Server Component RSC Team Member| Role| GitHub ---|---|--- 남인서| Research, PPT production, Presentation| @sene03 유승...

n8n-RCE-CVE-2025-68613

n8n Expression Injection RCE Analysis CVE-2025-68613 This repo contains the lab report I prepared for exploiting the vulnerable n8n service available on the Hackviser platform. In the study, I demonstrated how I performed a sandbox escape by using the expression evaluation mechanism on n8n and...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Spring4Shell Security Operations Analysis A hands-on Security Operations Centre SOC simulation where I performed the role of an Information Security Analyst responding to an active Spring4Shell exploitation attempt. This repository documents the full incident response lifecycle —...

CVE-2020-10257

/ \ \ / / || \ \ / |/ \ | | | \ V /| |/ / / / || | / /| \ / / | / || /// ||/|/// by darkcast CVE-2020-10257: WordPress TRX Addons Plugin Unauthenticated Remote Code Execution RCE Vulnerability Affected Plugin: TRX Addons Vulnerability Type: Unauthenticated Remote Code Execution RCE CVSS Score:...

CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType Variable Font Generator Exploit This repository contains a specialized exploit for the VariaType machine on Hack The Box. The exploit leverages a vulnerability in how the fontTools library or the web application handles .designspace XML files and metadata...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigating a PAN-OS CVE-2024-3400 Command Injection Attempt Overview This project documents the investigation of a CVE-2024-3400 command injection attempt targeting a PAN-OS GlobalProtect service. The goal was to determine: whether this is a real attack whether command execution occurred wheth...

CVE-2022-42889-Text4Shell-POC

CVE-2022-42889 Text4Shell Testing Script This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889. About Text4Shell CVE-2022-42889 Text4Shell is a critical vulnerability that affects a wide ran...