CVE-2025-11953-POC-

CVE-2025-11953 - React Native CLI RCE Forschungsumgebung 📋 Übersicht CVE-2025-11953 ist eine kritische Remote Code Execution RCE-Schwachstelle im Metro Development Server der React Native CLI, entdeckt von JFrog Security. Diese Forschungsumgebung bietet die tatsächliche anfällige Implementierung...

CVE-2025-11953-PoC

الوصف خادم التطوير Metro، الذي يفتحه واجهة أوامر React Native Community CLI، يرتبط بالواجهات الخارجية افتراضيًا. يعرّض الخادم نقطة نهاية معرضة لحقن أوامر نظام التشغيل. وهذا يسمح لمهاجمي الشبكة غير المصادق عليهم بإرسال طلب POST إلى الخادم وتشغيل ملفات تنفيذية عشوائية. على نظام Windows، يمكن...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ SCHWACHSTELLENDEMONSTRATION ⚠️ JFSA-2025-001495618 - Kritische Befehlseinschleusung in der React Native CLI CVE : CVE-2025-11953 CVSS-Score : 9.8 Kritisch Betroffenes Paket : @react-native-community/cli-server-api Verwundbare Versionen :...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9558: MDR: Post-upgrade 4.21 to 4.22 DRPolicy validation failure in Metro DR DFBUGS-9404: Backport to...

Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

MAL-2026-10674 Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

CVE-2024-37496

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7...

CVE-2024-37496

CVE-2024-37496 concerns the WordPress Metro Magazine theme (

CVE-2026-40809

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

EUVD-2026-37058

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

CVE-2026-40809

CVE-2026-40809 concerns the WordPress Metro Magazine theme (versions

WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Metro Magazine versions = 1.4.1...

Malicious code in metro-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e35441f182ca0b66905b74b51c0db61c1d641d7ecc920cdfef2ddedff38dda The package metro-evaluator was found to contain malicious code...

MAL-2026-1792 Malicious code in metro-evaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e35441f182ca0b66905b74b51c0db61c1d641d7ecc920cdfef2ddedff38dda The package metro-evaluator was found to contain malicious code...

CVE-2026-27383

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through = 2.13...

CVE-2026-27382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...

EUVD-2026-9636

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through = 2.13...

EUVD-2026-9635

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through = 2.13...