CVE-2025-61318

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature...

Exploit for Deserialization of Untrusted Data in Facebook React

🔥 React2Shell Toolkit - CVE-2025-55182 & CVE-2025-66478 !R...

CVE-2025-66562

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

Exploit for Deserialization of Untrusted Data in Facebook React

React Server Components RCE – README Description React S...

Exploit for Deserialization of Untrusted Data in Facebook React

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARN...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Description A pre-authentication remote cod...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - React Server Components RCE Scanner !Severi...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ WARNIN...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory f...

ZSPACE Q2C 命令注入漏洞

ZSPACE Q2C is a private cloud storage device from China's Extreme Space ZSPACE. A command injection vulnerability exists in ZSPACE Q2C NAS 1.1.0210050 and earlier versions, which stems from incorrect manipulation of the parameter safedir in the file /v2/file/safe/status, which could lead to a...

ZSPACE Q2C 命令注入漏洞

ZSPACE Q2C is a private cloud storage device from China's ZSPACE ZSPACE company. A command injection vulnerability exists in ZSPACE Q2C 1.1.0210050 and earlier versions, which stems from incorrect manipulation of the parameter safedir in the file /v2/file/safe/open, which could lead to a command...

The vulnerability of the `usb_parse_ss_endpoint_companion()` function in the drivers/usb/core/config.c file of the Linux kernel allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the usbparsessendpointcompanion function in the drivers/usb/core/config.c file of the Linux kernel lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and accessibility of the...

Exploit for CVE-2025-55182

CVE-2025-55182 some notes template: py !/usr/bin/env py...

Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows

On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution RCE vulnerability in React Server Components RSC, tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across...

Cross-site Scripting

pyloadng is vulnerable to Cross-site Scripting. The vulnerability is due to unsafe handling of untrusted parameters in the Captcha and CNL endpoints, allowing attackers to inject malicious content or manipulate request processing, leading to Cross-site Scripting or other unintended behaviors...

Remote Code Execution (RCE)

React Server Components are vulnerable to Remote Code Execution RCE. The vulnerability is due to the unsafe deserialization of attacker-controlled payloads sent to Server Function endpoints, which allows an attacker to execute arbitrary code without authentication...

VulnCheck KEV: CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components Pre-Auth RCE Exec...

Exploit for CVE-2025-55182

CVE-2025-55182 Proof-of-concept exploit for CVE-2025-55182, a...

CVE-2025-66458

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document...