CVE-2025-66478-Exploit-Poc

إثبات المفهوم PoC لثغرة Next.js CVE-2025-66478 English | 한국어 يحتوي هذا المستودع على إثبات مفهوم PoC لإعادة إنتاج ثغرة Next.js CVE-2025-66478 والبحث فيها. يتكون من تطبيق Next.js معرّض للثغرة وسكربت استغلال مكتوب بلغة Python لاختبار الثغرة. ما هي ثغرة CVE-2025-66478؟ هذه ثغرة تنفيذ كود برمجي عن بُع...

cve-2025-66478_rce_vulnerable

shadcn/ui के साथ आधुनिक ब्लॉग Next.js 16, React 19, shadcn/ui और Tailwind CSS के साथ बनाया गया एक आधुनिक और सुंदर ब्लॉग। महत्वपूर्ण: Next JS VULNERABLE परियोजना केवल शैक्षिक उद्देश्यों, परीक्षण और शोषण के लिए बनाई गई है, उत्पादन में स्थापना की अनुशंसा नहीं की जाती, केवल स्थानीय या नियंत्रित वाताव...

react2shell-exploit

CVE-2025-55182 – React2Shell تنفيذ الأوامر عن بُعد في Next.js ⚠️ إخلاء مسؤولية : هذه الوثائق مقدمة لأغراض تعليمية وبحوث أمنية فقط. أي استخدام غير مصرح به لهذه التقنيات ضد أنظمة لا تملكها أو ليس لديك إذن صريح لاختبارها غير قانوني. 📋 جدول المحتويات 1. نظرة عامة 2. كيف يعمل 3. التثبيت والإعداد 4...

CVE-2025-66478-PoC-Reverse-Shell

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server Actions Deserialization RCE PoC إثبات مفهوم لاستغلال CVE-2025-55182 — الملقب علنياً باسم "React2Shell" — وهي ثغرة تلويث النموذج الأولي prototype pollution من جهة الخادم في إلغاء تسلسل Server Actions لمكونات React Server Components...

Cerberus-React2Shell-Scanner-Exploit

Cerberus React2Shell - शस्त्रीकृत शोषण फ्रेमवर्क root@kitploit: ██████╗ ███████╗██████╗ ██████╗ ███████╗██████╗ ██╗ ██╗ ██╔════╝ ██╔════╝██╔══██╗██╔══██╗██╔════╝██╔══██╗██║ ██║ ██║ █████╗ ██████╔╝██████╔╝█████╗ ██████╔╝██║ ██║ ██║ ██╔══╝ ██╔══██╗██╔══██╗██╔══╝ ██╔══██╗██║ ██║ ╚██████╗ ███████╗██║...

CVE-2025-55182-shellinteractive

CVE-2025-55182-shellinteractive الأساس المستخدم من: https://github.com/Emiyelbarto/CVE-2025-55182-PoC شكرًا جزيلًا على المساهمة الرائعة. نظرة عامة CVE-2025-55182 هي ثغرة إلغاء تسلسل في Next.js/React Server Components تسمح للمهاجمين عن بُعد غير المصادَق عليهم بتنفيذ تعليمات برمجية عشوائية على...

Exploit for CVE-2025-66478

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server A...

CVE-2025-66478-Exploit-PoC

CVE-2025-66478 Exploit PoC Dieses Repository enthält Proof-of-Concept PoC-Code zur Reproduktion und Untersuchung der Next.js CVE-2025-66478-Sicherheitslücke. Es enthält eine verwundbare Next.js-Anwendung und ein Node.js-Exploit-Skript zum Testen der Schwachstelle. Englisch · 中文 Was ist...

next: Next.js: Denial of Service via excessive memory consumption in Server Actions

A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a denial of service DoS due to resource exhaustion...

next.js: Next.js: Denial of Service via crafted POST requests to server actions

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open,...

next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions

A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-Side Request Forgery SSRF, where the server is tricked int...

next: Next.js: Denial of Service via crafted requests to App Router with Server Actions

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — Next.js Flight Deserialization RCE Remote...

react2shell-poc

React2Shell PoC CVE-2025-55182 Skrip Proof of Concept PoC...

Linux Distros Unpatched Vulnerability : CVE-2026-64641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting...

Linux Distros Unpatched Vulnerability : CVE-2026-64646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js...

Linux Distros Unpatched Vulnerability : CVE-2026-64649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action...

CVE-2026-64646

A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a denial of service DoS due to resource exhaustion...

CVE-2026-64641

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and...

CVE-2026-64649

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...