challenge_repo

🎲 The Entropy Challenge 🇬🇧 Read in English | 🇹🇷 Türkçe Oku Introduction We have developed a next-generation random number generator that processes Radio Frequency RF Noise through a proprietary Neural Network architecture , followed by SHA-3 post-processing. We claim this source provides True...

react2shell-scanner

react2shell-scanner Triage scanner for CVE-2025-55182 R...

React-Next-Scanner

React-Next-Scanner Safe CLI scanner for CVE-2025-55182 and CVE-2025-66478 This tool provides a lightweight, non-exploitative vulnerability scanner focused on modern JavaScript stacks, specifically: API services affected by CVE-2025-55182 Next.js applications affected by CVE-2025-66478 It works on...

nexts-cve-2025-66478-exploit

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

cve-2024-3435

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

CVE-2025-55182

CVE-2025-55182 Nextjs POC A small repository containing: test-app/: a Next.js 16 React 19 test application using the App Router. exploit.js: a local proof-of-concept script used to demonstrate and test server behavior around multipart/Next-Action handling. Intended for local testing only...

PT-2026-107993

Name of the Vulnerable Software and Affected Versions Dislocker versions prior to 0.7.4 Description A heap out-of-bounds read occurs in the get dataset and get next datum functions because dataset and datum sizes are not validated against the metadata allocation. An attacker can create a BitLocke...

EUVD-2026-91673

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass...

Partial String Comparison

Overview Affected versions of this package are vulnerable to Partial String Comparison via the isPublicAdminRoute utility in packages/next/src/utilities/isPublicAdminRoute.ts, which incorrectly marks any route containing the substring /verify/ as a public admin route, regardless of whether it...

Overly Restrictive Account Lockout Mechanism

Overview Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. An attacker who triggers repeated failed login attempts to lock an account ca...

CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

CVE-2024-46982-NUCLEI

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun run dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying pages/index.js. The page...

CVE-2026-104391

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104391 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

EUVD-2026-94252

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104391

The ExpressTech Quiz And Survey Master (quiz-master-next) WordPress plugin, versions n/a through 11.2.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . This flaw stems from the Improper Neutralization of Input During Web Page Generation . While the documents confirm the existence of the vu...

CVE-2026-104391 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

react-cve-2025-55182-lab

Setup: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab Exploit: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...

CVE-2026-104391: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

PT-2026-107456

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...