CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Prova di concetto Questa repository contiene una prova di concetto PoC per CVE-2025-55182 , una vulnerabilità che coinvolge Prototype Pollution che porta a Remote Code Execution RCE in alcune implementazioni di rendering lato server. ⚠️ Avvertenza: Questa PoC è strettamente per scop...

SealSecurity_Exam

SealSecurityExam Prototype Pollution ist eine JavaScript-Sicherheitslücke, die es einem Angreifer ermöglicht, beliebige Eigenschaften zu globalen Objektprototypen hinzuzufügen, die dann von benutzerdefinierten Objekten geerbt werden können. Eine Prototype-Pollution-Quelle ist jede...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – JSON मर्ज पैच में प्रोटोटाइप प्रदूषण प्रोग्राम कोड Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutabl...

CVE-2025-55182-PoC

⚡ React2Shell Exploit PoC CVE-2025-66478 Esecuzione remota di codice RCE su Next.js tramite inquinamento del prototipo nei Server Components 🕵️‍♂️ Panoramica Questo repository contiene una Prova di Concetto PoC per CVE-2025-66478 indicata anche come CVE-2025-55182 in alcuni contesti, una...

GHSA-F4JP-RW7W-CCWG gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

EUVD-2026-60734

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-23929

Zabbix's searchParamsToObject() function failed to filter dangerous properties like __proto__ from URL parameters, enabling prototype pollution that, combined with jQuery's unsafe element creation traversing the prototype chain, results in persistent XSS in Maps. CVSS 4.0 scores this HIGH (8.5) w...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — Next.js Flight Deserialization RCE Remote...

CVE-2026-73088

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats in node.js, reached unconditionally through getStat and loadStat on every browserslist call, processes untrusted browserslist-stats.json, opts.stats, and...

UBUNTU-CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

CVE-2026-71437

Mermaid.js architecture diagrams are affected by prototype pollution in versions 11.5.0–11.16.1. A diagram-defined group with id proto uses the id as an object property key, allowing pollution of Object.prototype and potentially affecting embedding applications. The issue is fixed in Mermaid v11....

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

EUVD-2026-54242

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...

GHSA-JFJ6-75FJ-8934 protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...