CVE-2025-55182

CVE-2025-55182 Next.js RCE Reproduktionsanleitung Haftungsausschluss ⚠️ Dieses Tool ist nur für Sicherheitsforschung und Lehrzwecke bestimmt. Nicht für illegale Zwecke verwenden. ⚠️ Einführung in die Schwachstelle CVE-2025-55182 ist eine schwerwiegende Remote Code Execution RCE-Schwachstelle im...

CVE-2025-55182

CVE-2025-55182: React2Shell - Toolkit für Remote-Codeausführung in Next.js !WARNING Dieses Werkzeug wird nur für autorisierte Tests und Bildungszwecke bereitgestellt. Unautorisierter Netzwerkzugriff und Datenextraktion sind illegal. Die Benutzer sind dafür verantwortlich, dass sie vor der Nutzung...

CVE-2025-55182-React2Shell-CVSS-10.0-

البرنامج المتأثر: React Server Components الإصدارات 19.0.0, 19.1.0, 19.1.1, 19.2.0 نوع الثغرة: تنفيذ التعليمات البرمجية عن بُعد دون مصادقة عبر إلغاء التسلسل غير الآمن. الوصف: خلل في بروتوكول React Server Flight يسمح للمهاجمين غير المصادق عليهم بإرسال حمولات متسلسلة مصممة خصيصًا تستغل تلوث النموذج...

CVE-2025-53770

Exploit RCE SharePoint ToolPane Kit di ricerca sulla sicurezza per testare le vulnerabilità di SharePoint ToolPane Panoramica • Funzionalità • Per iniziare • Utilizzo • Struttura del progetto Questo repository contiene proof-of-concept di exploit e strumenti di analisi per la vulnerabilità...

CVE-2025-53772

CVE-2025-53772 - Exploit RCE di Microsoft Web Deploy Un exploit basato su Python per CVE-2025-53772, una vulnerabilità di esecuzione remota di codice in Microsoft Web Deploy msdeploy causata dalla deserializzazione non sicura dei dati dell'header HTTP. 🎬 POC Video Panoramica della Vulnerabilità...

CVE-2020-9496

CVE-2020-9496 Poiché le 2 richieste xmlrpc correlate in webtools xmlrpc e ping non utilizzano l'autenticazione, sono vulnerabili a una deserializzazione non sicura. Questo problema è stato segnalato al team di sicurezza da Alvaro Munoz [email protected] del GitHub Security Lab team. Versione...

CVE-2026-59285

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-10036

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...

CVE-2026-10036

SpeechBrain versions before 1.1.1 contain an arbitrary code execution vulnerability in its checkpoint recovery mechanism. The root cause is the use of PyYAML's unsafe loader when parsing CKPT.yaml metadata files during candidate enumeration in Checkpointer.recover_if_possible(). An attacker who c...

CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 React2Shell — Analyse de sécurité Aperçu Ce projet est une analyse technique de CVE-2025-55182, une vulnérabilité critique d'exécution de code à distance RCE divulguée en décembre 2025. La vulnérabilité affecte les composants serveur React et permet aux attaquants d'exécuter du cod...

CVE-2026-59285

Spring for GraphQL (versions 2.0.0 through 2.0.4 ) is vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. This means an attacker who can influence the pagination parameters of a GraphQL query could trigger deserialization of untrusted data, potentially leading to remot...

EUVD-2026-67174

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-33439-OpenAM

CVE-2026-33439 ist ein unsicheres Deserialisierungsproblem vor der Authentifizierung in OpenAM 16.0.6, das JATO-ViewBean-Endpunkte betrifft. Öffentliche Sicherheitshinweise erwähnen JATO-Endpunkte, listen jedoch keine erreichbaren Routen auf. Diese Forschung identifiziert...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Deserializzazione non sicura nell'instrumentazione RMI dell'OpenTelemetry Java Agent Gravità: Critica CVSS v4.0: 9.3 Versioni interessate: opentelemetry-javaagent 2.26.1 Corretta in: 2.26.1 rilasciata il 23 marzo 2026 Panoramica OpenTelemetry è probabilmente il framework di...

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat

Quebrando a Cadeia de Atualizações: Dentro do CVE-2025-59287 e a Ameaça de RCE no WSUS O CVE-2025-59287 é uma vulnerabilidade crítica de RCE no Windows Server Update Services WSUS causada pela desserialização insegura de dados não confiáveis. Ela permite que atacantes remotos executem código...

CVE-2026-47878

Spring Batch's DefaultExecutionContextSerializer , used by default in the JDBC job repository, deserializes Base64-decoded bytes via ObjectInputStream.readObject() without an ObjectInputFilter class allowlist, enabling unsafe Java deserialization . Affected versions are Spring Batch 6.0.0–6.0.4 a...

CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo يقوم Bio-Formats ≤ 8.3.0 بإلغاء تسلسل Java غير آمن لملفات ذاكرة التخزين المؤقت .bfmemo التي يتحكم فيها المهاجم أثناء معالجة الصور؛ يمكن أن يؤدي ملف .bfmemo مُصمم بعناية إلى إلغاء تسلسل بيانات غير موثوقة رفض الخدمة/التلاعب بالمنطق؛...

poc-cve-2025-55182

CVE-2025-55182 React2Shell - Prova di concetto ⚠️ ATTENZIONE: Questo repository è destinato esclusivamente a scopi educativi e di ricerca sulla sicurezza. Non utilizzare questo exploit contro sistemi di cui non sei proprietario o per i quali non hai esplicita autorizzazione al test. Panoramica...