react2shell-cve-2025-55182

🚨 React2Shell - CVE-2025-55182 Exploitation Framework Advanced exploitation framework for CVE-2025-55182 Next.js Remote Code Execution Author: opsecramdan 📚 Table of Contents Overview Vulnerability Details Features Requirements Installation Usage Interactive Shell Output Files Impact Mitigation...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

CVE-2026-84379

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The FileField.renderheaders function fails to validate Content-Type values and custom headers, allowing the injection of Carriage Return ...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379

HTTPX2 , a next-generation HTTP client for Python, is affected by a multipart part header injection vulnerability in FileField.render_headers() within src/httpx2/httpx2/_multipart.py. Prior to 2.11.0 , attacker-controlled content_type values and custom headers from files= tuples are interpolated ...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

Jenkins (via the Stapler web framework) is affected by a form data binding flaw in versions 2.579 and earlier (LTS 2.568.2 and earlier ). The root cause is that Stapler's form data binding allows setting public static fields of the bound configuration object, enabling attackers with the ability t...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84647

CVE-2026-84647 affects Stapler (the web framework used by Jenkins) in versions up to 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), shipped in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier . The root cause is that Stapler's form data binding does not restrict the object types that ca...

EUVD-2026-70113

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

CVE_2021_27850_POC

Usage root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Assuming the HMAC key is change...

s2-048

s2-048 Exploit para s2-048, CVE-2017-9791. root@kitploit: / \ \ / / | | \ / / | | / \ / / | | | \ \ / /| | | | | | | / /| | / / | | | | \ V / | ||/ /| || | | / /, |/ / , | | | / || ||/||// //// //|| poc: root@kitploit:...

CVE-2026-21876

CVE-2026-21876 Bypass de WAF de OWASP CRS Contenedor docker de CVE-2026-21876 + PoC mínimo. Quiero agradecer por separado a @airween y a @fzipi por su rápida respuesta. ¡La corrección de la vulnerabilidad estuvo lista en muy poco tiempo! PoC root@kitploit: POST /submit HTTP/1.1 Host: localhost...

PT-2026-84777

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

PT-2026-84770

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...