9361 matches found
Next.js Authorization Bypass
Proof of concept exploit for a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js middleware, potentially granting unauthorized access to sensitive...
Exploit for Server-Side Request Forgery in Microsoft
CVE-2025-29927 - Critical Security Vulnerability in Next.js...
Notable vulnerabilities in Next.js (CVE-2025-29927) and CrushFTP
Rapid7 is warning customers of two notable unrelated vulnerabilities in Next.js, a React framework for building web applications, and CrushFTP, a file transfer technology that has previously been targeted by adversaries. CVE-2025-29927 is a critical improper authorization vulnerability in Next.js...
Exploit for CVE-2025-29927
Testing script for CVE-2025-29927 Provided by CyberMaxx. CV...
Exploit for CVE-2025-29927
Testing script for CVE-2025-29927 Provided by CyberMaxx. CV...
Exploit for CVE-2025-29927
CVE-2025-29927: Next.js Middleware Bypass Vulnerability PoC T...
Vulnerability fixed in Next.js
Vercel has fixed a vulnerability in Next.js Specific to versions 14.2.25 and 15.2.3 Next.js is a popular framework for developing Web applications. The vulnerability is in the way Next.js handles authentication checks in its own middleware. This allows malicious actors to bypass these controls,...
Vercel Next.js Privilege Bypass Vulnerability
Next.js is Vercel open source a React framework. Vercel Next.js suffers from a privilege bypass vulnerability that stems from the fact that if authorization checking occurs in middleware, an attacker can use the vulnerability to bypass authorization checking...
IIOP Deserialization Remote Code Execution Vulnerability in Kingdee Apusic Application Server of Kingdee Software (China) Co.
Kingdee Apusic Application Server AAS is an enterprise-level middleware, which fully supports JakartaEE specification, provides Web, EJB, WebService containers, and adapts to domestic hardware and software, and is used to support the operation of enterprise-level applications. A remote code...
Incorrect Authorization
Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Authorization due to missing checks in transformMiddleware which ignore certain query parameters. An attacker can access unauthorized files by including a ?raw?? ...
Authorization Bypass
Next.js is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of the x-middleware-subrequest header, allowing attackers to bypass authorization checks in middleware...
Exploit for CVE-2025-29927
Introduction By manipulating the x-middleware-subrequest req...
Exploit for CVE-2025-29927
CVE-2025-29927: Next.js Middleware Bypass PoC Overview This...
Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks
A critical security flaw has been disclosed in the Next.js React framework that could be potentially exploited to bypass authorization checks under certain conditions. The vulnerability, tracked as CVE-2025-29927 , carries a CVSS score of 9.1 out of 10.0. "Next.js uses an internal header...
Exploit for CVE-2025-29927
CVE-2025-29927-POC Introduction This repository contains...
Exploit for CVE-2025-29927
CVE-2025-29927-PoC-Exploit Proof-of-Concept for Authorization...
Exploit for CVE-2025-29927
CVE-2025-29927-PoC-Exploit Proof-of-Concept for Authorization...
Exploit for CVE-2025-29927
Scanner de Vulnerabilidade Middleware Subrequest do Next.js U...
CVE-2025-29927
A flaw was found in Next.js package. This vulnerability allows bypassing authorization checks within a Next.js application if the authorization check occurs in middleware. Mitigation Block or drop external user requests which contain the x-middleware-subrequest header from reaching your Next.js...