CVE-2023-43208

Mirth Connect RCE - CVE-2023-43208 Descripción PoC para la ejecución remota de código RCE en Mirth Connect. Afecta a Mirth Connect Ejemplo Iniciar listener nc -lvnp 4444 Ejecutar el exploit ./exploit https://target.com 10.10.10.10 4444 Referencias https://nvd.nist.gov/vuln/detail/CVE-2023-43208...

CVE-2025-55182-React2Shell-CVSS-10.0-

Affected Software: React Server Components versions 19.0.0, 19.1.0, 19.1.1, 19.2.0 Vulnerability Type: Pre-authentication Remote Code Execution via insecure deserialization. Description: A flaw in the React Server Flight protocol allows unauthenticated attackers to send specially crafted serializ...

CVE-2025-55182

Escáner CVE-2025-55182 Un escáner de prueba de concepto para CVE-2025-55182 , una vulnerabilidad crítica de Ejecución Remota de Código RCE sin autenticación en React Server Components RSC. Resumen El 3 de diciembre de 2025, se reveló una vulnerabilidad crítica que afecta a aplicaciones React 19.x...

react2shell

React2Shell Herramienta CLI + plantillas de Nuclei para detectar dos vulnerabilidades críticas de RCE en React Server Components y Next.js Server Actions. El escáner fue reescrito basándose en la vulnerabilidad react2shell divulgada. Resumen de vulnerabilidades CVE-2025-55182 – RCE por...

CVE-2025-61882-Oracle-BI-Publisher-RCE

Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...

CVE-2026-84645

CVE-2026-84645 — Jenkins PersistenceRoot Deserialization RCE SECURITY-3972 PoC for the Jenkins deserialization vulnerability fixed on 2026-09-02 advisory. A low-privileged account holding Item/Configure on any single job can turn that into arbitrary code execution as the Jenkins OS user. | ---|--...

CVE-2025-55182-React2Shell-Exploit

Next.js React2Shell CVE-2025-55182 Expl0it A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION LEGAL USE ONLY : Use exclusively against systems you...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

CVE-2018-15133-PoC

CVE-2018-15133-PoC Este script Python implementa un exploit de ejecución remota de código RCE para aplicaciones Laravel vulnerables mediante deserialización insegura, basándose en la vulnerabilidad CVE-2018-15133. El exploit aprovecha una vulnerabilidad en Laravel versiones 5.5.40 y anteriores, y...

CVE-2025-55182-Scanner

CVE‑2025‑55182 – Escáner de RCE por Deserialización RSC en Next.js Esta herramienta verifica si un objetivo es vulnerable a CVE‑2025‑55182 , un fallo de Ejecución Remota de Código causado por el manejo inseguro de cargas útiles de modelo RSC React Server Components dentro de Next.js. La...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React Server Components RCE A Proof-of-Conce...

CVE-2025-53770

CVE-2025-53770 Research Lab This repository appears to be a proof-of-concept research project for validating a SharePoint-style deserialization and tool-pane processing issue in a controlled lab. It includes a Python driver, a mock vulnerable application, and container assets for isolated testing...

Project-Vuln-Detection-N-Mitigation_101

Project-Vuln-Detection-N-Mitigation101 Apache ActiveMQ Deserialization RCE CVE-2023-46604 – Phase 2 Project Security Architectures & Systems Administration Author: Vaishnavu C V · Date: 17 Sep 2025 Status: ⌀ Phase 2 deliverables complete Overview This repository documents a hands‑on security desi...

CVE-2025-49113_exploit_cookies

CVE-2025-49113 - Roundcube Webmail 원격 코드 실행 취약점 기술 개요 CVE-2025-49113은 Roundcube Webmail에서 인증된 원격 코드 실행을 가능하게 하는 심각한 안전하지 않은 역직렬화 취약점입니다. 이 취약점은 파일 업로드 작업 중 직렬화된 PHP 객체를 부적절하게 처리하는 데서 비롯됩니다. 취약점 분석 근본 원인 : 파일 업로드 기능에서 사용자 제어 데이터의 안전하지 않은 역직렬화 공격 벡터 : 악성 직렬화된 PHP 객체를 포함한 조작된 파일 업로드 요청 기술적 세부 사항 :...

CVE-2025-61765_PoC

Summary A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc para CVE-2019-9081, este CVE es solo una nueva cadena POP. El proyecto es una aplicación Laravel 5.7.x vulnerable preconstruida con un punto de entrada para la vulnerabilidad POI en la URI /deserialize solicitud POST. Configuración del laboratorio: Iniciando la aplicación...

CVE-2019-18935-exploit-study

CVE-2019-18935-exploit-study In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies...

CVE-2025-24813

CVE-2025-24813 Description This repo aims to provide clear instructions for rapid deployment of Tomcat v9.0.90 with java 25.0.1 2025-10-21 LTS on Windows Server 2019 Standard for Cyber Security threat emulation exercise. The exploit.py leverages on ysoserial-all.jar to create a payload using...

React2Shell-CVE-2025-55182-Testing-Environment

Entorno de Pruebas React2Shell CVE-2025-55182 Un entorno de pruebas contenerizado para CVE-2025-55182, una vulnerabilidad crítica 10.0 CVSS de Ejecución Remota de Código en React Server Components. ⚠️ ADVERTENCIA Este entorno es intencionalmente vulnerable y solo debe usarse para: Investigación y...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands on the...