CVE-2025-55182-React2Shell-Lab

CyberSec Blog CTF - React2Shell PoC Ce dépôt fournit un environnement CTF Capture The Flag vulnérable basé sur un blog de cybersécurité utilisant Next.js et React Server Components. CVE-2025-55182 : Vulnérabilité d'exécution de code à distance RCE pré-authentification dans React Server Components...

CVE-2025-55182

Preuve de concept React2Shell Ce dépôt fournit un environnement minimal intentionnellement vulnérable pour tester les scanners de sécurité contre la récente vulnérabilité critique d'exécution de code à distance RCE React2Shell affectant les composants serveur React et Next.js. CVE-2025-55182 : Un...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

CVE-2025-55182

CVE-2025-55182 RCE Инструмент для самопроверки, используется для проверки уязвимости CVE-2025-55182 Принцип уязвимости React Server Components при декодировании полезной нагрузки, отправляемой на конечные точки серверных функций, содержат дефект разрешения пути. Путем разделения свойств объекта...

RSC-Scanner-POC

Scanner de divulgation du code source RSC Next.js Un scanner de sécurité pour détecter la CVE-2025-55183 - la vulnérabilité de divulgation du code source des composants serveur React RSC de Next.js. Description Ce scanner détecte la divulgation de code source dans les composants serveur React RSC...

CVE-2025-55183_POC

CVE-2025-55183 - Next.js RSC 서버 함수 소스 코드 노출 Next.js React Server ComponentsRSC의 소스 코드 노출 취약점입니다. 취약한 서버 함수로 전송된 악의적인 HTTP 요청은 인수가 문자열화될 때 모든 서버 함수의 소스 코드를 안전하지 않게 반환할 수 있습니다. 참고 작성자 : X/Twitter의 AndrewMohawk 실습 환경 설정 root@kitploit: git clone https://github.com/AndrewMohawk/RSC-sample-app.git cd...

Unihackers---CVE-2025-55182-

عصابة إيطالية React2Shell PoC يوفر هذا المستودع بيئة صغيرة معرضة للخطر عمدًا لاختبار الماسحات الأمنية ضد ثغرة تنفيذ الأوامر عن بُعد الحرجة الأخيرة React2Shell التي تؤثر على مكونات خادم React و Next.js. CVE-2025-55182 : توجد ثغرة تنفيذ أوامر عن بُعد بدون مصادقة في مكونات خادم React الإصدارات 19.0....

React2Shell

@React2Hell — استغلال CVE-2025-55182 🔥 استغلال تنفيذ التعليمات البرمجية عن بُعد RCE لخادم Next.js / React root@kitploit: █████▄ ▄▄▄▄▄ ▄▄▄ ▄▄▄▄ ▄▄▄▄▄▄ ████▄ ▄▄▄▄▄ ██ ██ ▄▄▄▄▄ ▄▄ ▄▄ ██▄▄██▄ ██▄▄ ██▀██ ██▀▀▀ ██ ▄██▀ ██▄▄ ██████ ██▄▄ ██ ██ ██ ██ ██▄▄▄ ██▀██ ▀████ ██ ███▄▄ ▄▄▄███ ██ ██ ██▄▄▄ ██▄▄▄ ██▄...

React2Hell

🧨 React2Hell — Exploitation de CVE-2025-55182 🔥 Exploitation d'exécution de code à distance RCE sur serveur Next.js / React root@kitploit: █████▄ ▄▄▄▄▄ ▄▄▄ ▄▄▄▄ ▄▄▄▄▄▄ ████▄ ██ ██ ▄▄▄▄▄ ▄▄ ▄▄ ██▄▄██▄ ██▄▄ ██▀██ ██▀▀▀ ██ ▄██▀ ██████ ██▄▄ ██ ██ ██ ██ ██▄▄▄ ██▀██ ▀████ ██ ███▄▄ ██ ██ ██▄▄▄ ██▄▄▄ ██▄...

CVE-2025-55182

CVE-2025-55182 Сканер и эксплойт !Warning Этот репозиторий предназначен исключительно для образовательных и исследовательских целей. Используйте предоставленные PoC только на системах, которыми вы владеете или на которые имеете явное разрешение для тестирования. Несанкционированный доступ ,...

React4Shell

استغلال React2Shell إثبات المفهوم PoC لثغرة تنفيذ التعليمات البرمجية عن بُعد في مكونات خادم React RSC / Next.js. الوصف توجد ثغرة تنفيذ تعليمات برمجية عن بُعد قبل المصادقة في إصدارات مكونات خادم React 19.0.0 و19.1.0 و19.1.1 و19.2.0 بما في ذلك الحزم التالية: react-server-dom-parcel...

react-vuln-scanner

Scanner de vulnérabilité React CVE-2025-55182 Un script bash pour analyser votre serveur à la recherche d'applications React vulnérables à CVE-2025-55182 — une vulnérabilité critique d'exécution de code à distance CVSS 10.0 dans les composants serveur React. ⚠️ À propos de la vulnérabilité Le 3...

React2Shell_Rce-cve-2025-55182

RCE des Composants Serveur React – README Bonjour, j'espère sincèrement que tout va bien de votre côté de l'écran ! 😊✨ Description Les versions 19.0.0 , 19.1.0 , 19.1.1 et 19.2.0 de React Server Components, y compris react-server-dom-parcel, react-server-dom-turbopack et react-server-dom-webpack,...

CVE-2026-53551

The vulnerability CVE-2026-53551 affects free5GC AUSF prior to version 1.4.5, where the supiOrSuci field in UE authentication requests is not validated. Null bytes (\x00) and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go’s net...

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling...

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

PYSEC-2026-1407 Gradio's Component Server does not properly consider` _is_server_fn` for functions

Component Server in Gradio before 4.13 does not properly consider isserverfn for functions...

CVE-2026-12199

A vulnerability in nltk.app.wordnetapp up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request /SHUTDOWN%20THE%20SERVER to...