CVE-2026-78388

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a cross-site request forgery (CSRF) (CWE-352). This vulnerability allows an attacker to execute malicious and unauthorized actions by leveraging a user's tru...

React2Shell

React2Shell – Advanced Discovery & Exploitation Framework An advanced React Server Components RSC vulnerability scanner and exploiter for CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications. This tool expands upon the original React2Shell research and proof-of-concept by introducing...

agentic-workflow-injection

Agentic workflow injection: fixtures and a coverage comparison Reproducible vulnerable/fixed fixtures for the class of bug published as CVE-2026-44246 nnU-Net, agentic workflow injection, CVSS 7.2, CWE-1427, plus the measured output of three detectors against them. It exists because there was...

gha-lab-b1fe4918c0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of AdeptLanguage/Adept at commit...

CVE-2025-55182-poc

CVE-2025-55182-poc A proof-of-concept PoC exploit for CVE-2025-55182 , targeting an unauthenticated Remote Code Execution RCE vulnerability in Next.js Server Actions. This exploit abuses prototype pollution during the deserialization of React Server Components RSC multipart payloads to inject...

CVE-2025-55182-TOOLS

CVE-2025-55182 Exploit Tool CVE-2025-55182 Comprehensive Exploitation/Detection Tool Developed byMingYi Security Lab Features Vulnerability Detection : Batch scan multiple targets for the vulnerability Path Scanning : Scan common Server Action endpoints to discover vulnerable paths Remote Code...

gha-lab-becf103a54

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of wazuh/wazuh at commit...

gha-lab-23db52563c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of nrwl/nx at commit...

gha-lab-40e23db109

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

gha-lab-d9fd584b12

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of DIYgod/RSSHub at commit...

gha-lab-6ab39df295

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of espressif/arduino-esp32 at commit...

gha-lab-ee08e207a8

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

r2s

React2Shell R2S - CVE-2025-55182 Testing Tool Advanced exploitation testing tool for CVE-2025-55182 vulnerability assessment Features • Installation • Usage • Testing Environment • Legal 📖 What is R2S? R2S React2Shell is a security testing tool designed to help security researchers, developers, a...

cve-2026-31431

CVE-2026-31431 Copy Fail Test This repository contains a workflow file for GitHub Actions to test whether the action runner is affected by CVE-2026-31431. You can do the test by yourself, just create a repository by this template and trigger the test.yml workflow manually remember to change the o...

CVE-2026-25514

CVE-2026-25514: FacturaScripts has SQL Injection in Autocomplete Actions Overview Field| Details ---|--- CVE ID| CVE-2026-25514 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products facturascripts/facturascripts versions: 2025.81 CWE Classification CWE-20: Improper...

CVE-2026-39866

CVE-2026-39866 — Command Injection via unquoted workflow dispatch input Proof-of-concept lab for command injection in GitHub Actions workflow dispatch Purpose CVE-2026-39866 is a command injection bug in Lawnchair's GitHub Actions release workflow. The releaseupdate.yml file passes user input...

CVE-2026-1375

CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...

CVE-2025-55182-Auto-Scanner

CVE-2025-55182 Scanner is a high-performance tool for detecting vulnerable Next.js Server Action endpoints. It uses multi-threaded scanning, confidence-based detection, and multiple response indicators to identify potential Remote Code Execution RCE vulnerabilities. Features - High-speed concurre...

CVE-2025-55183

CVE-2025-55183 Scanner for React Server Functions source code exposure vulnerability. What is this? CVE-2025-55183: React 19.0.0-19.2.1 Server Actions can be exploited to expose their full source code including hardcoded secrets, API keys, and database credentials. References:...

rust-cve-2025-55182-scanner

CVE-2025-55182 Scanner Rust A high-performance, concurrent vulnerability scanner written in Rust for detecting CVE-2025-55182 Next.js Server Actions RCE across multiple targets. 🚀 Features ⚡ High-performance Rust implementation 🧵 Multi-threaded scanning engine ⏱ Adjustable timeout & retry system ...