347942 matches found
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
EUVD-2026-95427
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
CVE-2026-78659
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...
react2shell
React2Shell Uno strumento CLI per sfruttare le vulnerabilità di prototype pollution nei React Server Components / Server Actions CVE-2025-55182 & CVE-2025-66478, consentendo l'esecuzione remota di codice RCE su server vulnerabili. PoC originale :...
Unihackers---CVE-2025-55182-
ITALIAN GANG React2Shell PoC Questo repository fornisce un ambiente minimale intenzionalmente vulnerabile per testare gli scanner di sicurezza contro la recente vulnerabilità critica di RCE React2Shell che interessa React Server Components e Next.js. CVE-2025-55182 : Esiste una vulnerabilità di...
CVE-2025-12999
A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without...
EXPLOIT-CVE-2025-55182
CVE-2025-55182 Proof of Concept Überblick Eine praktische Demonstration von CVE-2025-55182 React2Shell – einer kritischen RCE-Schwachstelle in React Server Components. Details zur Schwachstelle CVE-ID : CVE-2025-55182 Typ : Remote Code Execution durch Prototype Pollution CVSS : 9.8 KRITISCH...
AZL-106833 CVE-2026-107718 affecting package httpd 2.4.68-1
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...
CVE-2026-107718
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...
CVE-2025-55182_liyon
CVE-2025-55182 - Esecuzione Remota di Codice nei React Server Components ⚠️ Dichiarazione legale : Questo strumento è destinato esclusivamente alla ricerca sulla sicurezza, ai test di penetrazione autorizzati e a scopi educativi. Utilizzare questo strumento su sistemi target senza autorizzazione...
EUVD-2026-95342
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...
CVE-2026-107718
The AdonisJS HTTP Server package is vulnerable to open redirects in versions prior to 8.2.3 and 9.3.0 . The root cause is the failure to use encodeURIComponent within the shared createURL() helper, which is utilized by Router.makeUrl() and Response.redirect().toRoute(). If an application includes...
CVE-2026-107718 AdonisJS: Unencoded route parameters can produce open redirects
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...
Exploit for Path Traversal in Apache Http_Server
Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...
React2shell-CVE-2025-55182-checker
CVE-2025-55182 React2Shell Detection Tool Strumenti di rilevamento per individuare componenti React Server vulnerabili nella tua infrastruttura. Avvio rapido Install dependencies pip3 install requests Version detection passive, safe for production python3 checker.py -u https://your-app.com Cosa è...
