react2shell-scanner

react2shell-scanner A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. For technical details on the vulnerability and detection methodology, see our blog post:...

CVE-2022-31199

CVE-2022-31199 - Netwrix Auditor RCE Exploit POCs 🔍 Vulnerability Overview CVE-2022-31199 is a critical insecure object deserialization vulnerability in Netwrix Auditor versions prior to 10.5. The vulnerability exists in an unsecured .NET Remoting service listening on TCP port 9004, allowing...

VulnLab

VulnLab A web vulnerability lab project developed by Yavuzlar. Logo Vulnerabilities SQL Injection Cross Site Scripting XSS Command Injection Insecure Direct Object References IDOR Cross Site Request Forgery CSRF XML External Entity XXE Insecure Deserialization File Upload File Inclusion Broken...

CVE-2019-18935

CVE-2019-18935 Proof-of-concept exploit for a .NET JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX allowing remote code execution. Description Telerik UI for ASP.NET AJAX is a widely used suite of UI components for web applications. It insecurely deserializes JSON objects in a...

CVE-2025-55184

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2017-5645

CVE-2017-5645 CVE-2017-5645 - Apache Log4j RCE due Insecure Deserialization...

php_code_analysis

this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: python code.py file.php -this will scan one file...

CVE-2020-35728

Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl. How to RCE pom.xml 4.0.0...

CVE-2019-17564

CVE-2019-17564 CVE-2019-17564 : Apache Dubbo Deserialization Remote Code Execution...

CVE-2026-25769

CVE-2026-25769 - Remote Code Execution via Insecure Deserialization in Wazuh Cluster A proof-of-concept exploit for CVE-2026-25769, a Remote Code Execution via Insecure Deserialization in Wazuh Cluster Usage: $ python3 poc.py --cmd 'id' Vulnerable Versions Wazuh v4.14.1 Disclaimer This tool is fo...

CVE-2025-66478-Exploit-Poc

Next.js CVE-2025-66478 PoC English | 한국어 This repository contains a Proof of Concept PoC for reproducing and researching the Next.js CVE-2025-66478 vulnerability. It consists of a vulnerable Next.js application and a Python exploit script to test the vulnerability. What is CVE-2025-66478? This is...

CVE-2026-113356

A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw race condition during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization...

CVE-2026-0596-Reproduction

Below is a structured, markdown-formatted vulnerability research report tailored for a GitHub repository layout such as a README.md or a security-labs write-up. It outlines the context, architecture, reproduction steps, and remediation strategies based on your lab findings. CVE-2026-0596: Arbitra...

react2shell-burp

React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...

CVE-2025-50461

CVE-2025-50461: Remote Code Execution via Unsafe Model Deserialization in Verl Status: RESERVED This CVE ID has been assigned but is not yet published in the official CVE list. A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script whe...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

Telerik-UI-ASP.NET-AJAX-Exploitation

Telerik-UI-ASP.NET-AJAX-Exploitation Unrestricted File Upload by Weak Encryption affected versions CVE-2017-11317 2. Remote Code Execution by Insecure Deserialization - CVE-2019-18935...

CVE-2023-46604

Technical Summary of the Attack: CVE-2023-46604 The script exploits an insecure deserialization vulnerability in Apache ActiveMQ CVE-2023-46604 to achieve remote code execution on the target server. Description of the Exploitation Process Vulnerability Target: The vulnerability resides in the...

CVE-2026-113404

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...