react2shell-scanner

react2shell-scanner React Server Components를 사용하는 Next.js 애플리케이션에서 CVE-2025-55182 및 CVE-2025-66478을 탐지하는 명령줄 도구입니다. 취약점 및 탐지 방법론에 대한 기술적 세부 사항은 블로그 게시물을 참조하세요: https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478 작동 방식 기본적으로 스캐너는 결...

react2shell-scanner

react2shell-scanner CVE-2025-55182 및 CVE-2025-66478 원격 코드 실행을 탐지하는 고정밀 명령줄 취약점 스캐너입니다. Next.js 애플리케이션에서 React Server ComponentsRSC를 사용하는 환경을 대상으로 합니다. 🚨 취약점 개요 이 치명적인 취약점들은 React Server Components를 사용하는 Next.js 애플리케이션에 영향을 미치며, 조작된 multipart POST 요청을 통해 인증되지 않은 원격 코드 실행을 가능하게 합니다. 영향을 받는 버전: 취약한 ...

React-2-Shell

This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution RCE vulnerability in React Server Components 🔥 CVE-2025-55182 Background CVE-2025-55182 also widely referred to as “React2Shell” is a critical remote code execution RCE vulnerability found in React Serve...

PT-2026-72015

Name of the Vulnerable Software and Affected Versions Netis NC63 version V3.0.0.3327 Description An authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher allows unauthenticated attackers to upload unsigned firmware images. The Boa web server grants access to any path...

CVE-2024-14037 Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed...

CVE-2024-14037: Unrestricted Upload of File with Dangerous Type

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed...

PT-2026-50629

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace file function. This makes i...

CVE-2022-50993

Weaver Fanwei E-office versions prior to 10.020221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types...

CVE-2022-50993

Weaver Fanwei E-office versions prior to 10.020221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types...

VulnCheck KEV: CVE-2022-50993

Weaver Fanwei E-office versions prior to 10.020221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types...

CVE-2026-40189: Missing Authorization

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...

DEBIAN-CVE-2026-29076

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex libstdc++ to parse RFC 5987 encoded filename values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep...

CVE-2026-22034

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...

DEBIAN-CVE-2026-22034

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...

CVE-2026-22034 Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...

CVE-2026-22034

Summary: CVE-2026-22034 affects Snuffleupagus prior to v0.13.0 where enabling the non-default upload validation feature to use upstream VLD scripts, without the VLD extension available to the CLI SAPI, causes all files in multipart POST requests to be evaluated as PHP code. This can enable remote...

CVE-2026-22034 Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...

CVE-2026-22034

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...

PT-2026-2140

Name of the Vulnerable Software and Affected Versions Snuffleupagus versions prior to 0.13.0 Description Snuffleupagus is a module designed to increase the cost of attacks against websites by eliminating bug classes and offering a virtual patching system. In deployments of Snuffleupagus before...

CVE-2026-22034: Not Failing Securely

Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream...