DEBIAN-CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

DEBIAN-CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

Explotando-FreeFloatFTP-CVE-2025-5548

Explotando-FreeFloatFTP-CVE-2025-5548 私のエクスプロイト研究開発リポジトリへようこそ。このプロジェクトは、FreeFloat FTP Server で見つかった脆弱性 CVE-2025-5548 （スタックベースのバッファオーバーフロー）に関する完全な技術分析、環境準備、そしてステップバイステップのエクスプロイト過程を文書化したものです。 🌱 個人的なメモ:...

react2shell-scanner

react2shell-scanner CVE-2025-55182 및 CVE-2025-66478 원격 코드 실행을 탐지하는 고정밀 명령줄 취약점 스캐너입니다. Next.js 애플리케이션에서 React Server ComponentsRSC를 사용하는 환경을 대상으로 합니다. 🚨 취약점 개요 이 치명적인 취약점들은 React Server Components를 사용하는 Next.js 애플리케이션에 영향을 미치며, 조작된 multipart POST 요청을 통해 인증되지 않은 원격 코드 실행을 가능하게 합니다. 영향을 받는 버전: 취약한 ...

CVE-2025-55182

CVE-2025-55182: React2Shell - Next.js リモートコード実行ツールキット !WARNING このツールは、許可されたテストおよび教育目的のみで提供されます。無断のネットワークアクセスやデータの外部送信は違法です。このツールをネットワーク上で使用する前に、適切な許可を得ていることを確認するのはユーザーの責任です。 概要 このリポジトリには、React2Shell としても知られる CVE-2025-55182 を検証・エクスプロイトし、対話型シェルを取得するためのシンプルなツールキットが含まれています。これは React Server Components...

SNet

SNet 일본어 버전 AI를 사용하여 플래그를 탈취하는 CTF입니다. 침투 테스트 경험이 없으신가요? 문제 없습니다. Claude Code가 개인 트레이너 역할을 합니다 — 환경을 설정하고, 도구 사용법을 알려주며, 실제 공격 기술을 단계별로 안내합니다. 모든 명령어는 직접 입력합니다. SNet이란? SNet은 실제 운영 중이던 서버를 기반으로 구축된 취약한 가상 머신입니다. 교과서적인 연습 문제가 아닙니다 — 실제 시스템 관리자들이 남긴 설정 파일, 잊혀진 스크립트, 방치된 자격 증명, 그리고 잘못된 결정들이 겹겹이 쌓여 있...

CVE-2025-471812-POC

/ | / | / / | / / / |/ // / / / / / / &password= 2. 서버는 "anonymous"를 인증하지만NULL에서 잘림 전체 페이로드가 세션 파일에 기록됨 → UID 쿠키 반환 3. GET /dir.html Cookie: UID= 서버가 세션 파일 로드 → 주입된 Lua 실행 → RCE 설치 git clone https://github.com/d3vn0mi/cve2025471812poc.git cd cve2025471812poc pip install requests 사용법 빠른 취약점 확인...

CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

EUVD-2026-95427

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

react2shell

React2Shell React Server Components / Server Actions의 프로토타입 오염 취약점CVE-2025-55182 및 CVE-2025-66478을 악용하여 취약한 서버에서 원격 코드 실행RCE을 가능하게 하는 CLI 도구입니다. 원본 PoC : https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc 경고: 이 도구는 현재 야생에서 적극적으로 악용되고 있는 심각한 취약점CVSS 10.0을 대상으로 합니다. 소유한 시스템이나 명시적...

Unihackers---CVE-2025-55182-

イタリアン・ギャング React2Shell PoC このリポジトリは、React Server Components と Next.js に影響する最近の重大な RCE 脆弱性（React2Shell）に対するセキュリティスキャナをテストするための、意図的に脆弱な最小限の環境を提供します。 CVE-2025-55182 : React Server Components のバージョン 19.0.0、19.1.0、19.1.1、19.2.0 には、事前認証のリモートコード実行脆弱性が存在します。影響を受けるパッケージは...

CVE-2025-12999

A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without...

EXPLOIT-CVE-2025-55182

CVE-2025-55182 개념 증명 개요 CVE-2025-55182 React2Shell에 대한 실용적인 데모 - React Server Components의 치명적인 RCE 취약점입니다. 취약점 세부 사항 CVE 식별자 : CVE-2025-55182 유형 : 프로토타입 오염을 통한 원격 코드 실행 CVSS : 9.8 치명적 영향받는 버전 : React 19.0.0, 19.1.0, 19.1.1, 19.2.0 공격 벡터 React Server Components는 FormData를 안전하지 않게 역직렬화합니다. 특별히 조작된...

AZL-106833 CVE-2026-107718 affecting package httpd 2.4.68-1

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...