Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

Next.js RSC RCE Scanner Extensión de Burp Suite Una extensión de Burp Suite de alta fidelidad para detectar la vulnerabilidad Ejecución remota de código en Next.js / React Server Components RSC CVE-2025-55182 y CVE-2025-66478. Esta extensión implementa la lógica de detección descubierta por el...

ThisSeemsWrong

此问题的修复以 CVE-2024-49746 的形式出现：公告，补丁 "这看起来不对" 上面的标题是来自 Parcel::continueWrite 方法 的注释，该方法实际上负责调整 Parcel 对象的大小，无论是用户显式请求时（例如通过 setDataSize），还是在当前数据容量过小时调用某个 write 方法cpp statust Parcel::continueWritesizet desired // SNIP: Validate desired size // SNIP: Assign kernelFields & rpcFields from variant membe...

LeakValue

Android 13 introduce muchas mejoras para endurecer el mecanismo de serialización Parcel Aquí está la presentación del equipo de Seguridad y Privacidad de Android sobre las mejoras realizadas Eso es genial, definitivamente elimina o vuelve inexplotables muchas vulnerabilidades. También describen...

CVE-2017-13286

CVE-2017-13286 CVE-2017-13286 Poccan not use All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm 引起这个漏洞的主要原因是parcel对象读写不一致，具体可以追溯到如下代码 root@kitploit: public void writeToParcelParcel dest, int flags if dest == null throw new IllegalArgumentException"dest must not b...

BadParcel

BadParcel Consulta Bundle Fengshui para una inmersión profunda en esta clase de errores. Este repositorio contiene un PoC para CVE-2023-20963, que es una discrepancia en la lógica de parcel/unparcel de Android WorkSource. La vulnerabilidad está parcheada en el Security Bulletin de Android de marz...

ReparcelBug

Android writeToParcel/createFromParcel 不匹配漏洞 PoC 查看 https://github.com/michalbednarski/IntentsLab/issues/2issuecomment-344365482 了解该漏洞的描述。 此仓库包含 CVE-2017-0806 的 PoC，该漏洞是 GateKeeperResponse 类中的不匹配问题。...

CVE-2015-1474_poc

此代码旨在作为CVE-2015-1474的PoC尝试。 该代码基于screencap命令的代码，但生成一个恶意Parcel，当反序列化时会导致surfaceflinger崩溃。 更多信息请参考 http://forum.xda-developers.com/kindle-fire-hdx/orig-development/evaluating-cve-2015-1474-to-escalate-to-t3045163。 克隆至 frameworks/base/cmds/badscreencap，并使用 mmm frameworks/base/cmds/badscreencap 编译。...

ResourcePoison

La corrección para este problema ha aparecido como CVE-2025-22441: boletín parche seguimiento Pasando ApplicationInfo ApplicationInfo es una estructura que define diversa información sobre una aplicación instalada, sobre todo la ruta al archivo apk desde el que se cargan los recursos y el código...

ReparcelBug2

CVE-2021-0928, discrepancia de serialización writeToParcel/createFromParcel en android.hardware.camera2.params.OutputConfiguration Este es un exploit que utiliza esa vulnerabilidad para escalar privilegios desde una app de Android instalada hacia la app de Configuración de Android o cualquier otr...

-CVE-2025-55182

🔍 GitHub CVE Scanner - Guía de uso Script para escanear repositorios de GitHub en busca de vulnerabilidades conocidas en proyectos React y Next.js. 📋 Vulnerabilidades detectadas El escáner verifica las siguientes CVEs: CVE-2025-55182 : Vulnerabilidad en React Server Components Afecta: React 19.0....

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

The vulnerability CVE-2026-44907 is a Denial of Service affecting React server-side rendering components. An attacker can trigger high CPU usage by sending specially crafted HTTP requests to server function endpoints in affected packages: react-server-dom-webpack, react-server-dom-parcel, and rea...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

EUVD-2026-39188

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702 InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702

The CVE concerns the InPost PL WordPress plugin (before 1.9.1) failing to verify that a request to update the WooCommerce order parcel-locker destination originates from the legitimate buyer. This allows unauthenticated attackers to silently redirect the shipping destination of any pending or pro...

CVE-2026-9607

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...