Metasploit Wrap-Up 12/12/2025

React2shell Module As you may have heard, on December 3, 2025, the React team announced a critical Remote Code Execution RCE vulnerability in servers using the React Server Components RSC Flight protocol. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0 and is informally...

📄 Magento SessionReaper Remote Code Execution

This Metasploit module exploits CVE-2025-54236 SessionReaper, a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an...

The Grim SessionReaper (CVE-2025-54236) Comes to Collect for Halloween

...

Thousands of online stores at risk as SessionReaper attacks spread

Early September, a security researcher uncovered a new vulnerability in Magento, an open-source e-commerce platform used by thousands of online retailers, and its commercial counterpart Adobe Commerce. It sounds like something straight out of a horror movie: SessionReaper. Behind the cinematic na...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

PT-2025-37037

Adobe released an emergency fix for “SessionReaper,” a critical Adobe Commerce/Magento flaw CVE-2025-542360, CVSS 9.1 enabling session hijacking and potentially unauthenticated RCE. No in-the-wild exploitation reported; patches and guidance are available...

PT-2025-36491

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.10 Magento Open Source affected versions not specified Description An improper input validation issue, known as SessionReaper, exists in the REST API, specifically within the ServiceInputProcessor and the...