CVE-2015-1474_poc

Ce code est une tentative de proof of concept PoC pour CVE-2015-1474. Le code est basé sur celui de la commande screencap, mais génère un parcel malveillant qui fait planter le surfaceflinger lorsqu'il est désérialisé. Voir plus sur...

ReparcelBug

PoC du bug de décalage writeToParcel/createFromParcel Android Voir https://github.com/michalbednarski/IntentsLab/issues/2issuecomment-344365482 pour la description du bug. Ce dépôt contient le PoC pour CVE-2017-0806, qui est un décalage dans la classe GateKeeperResponse...

ThisSeemsWrong

Le correctif pour ce problème est apparu sous le nom CVE-2024-49746 : bulletin, correctif "Cela semble faux" Le titre ci-dessus est le commentaire de la méthode Parcel::continueWrite, qui est en réalité responsable du redimensionnement des objets Parcel, soit lorsqu'il est explicitement demandé p...

LeakValue

Android 13 introduit de nombreuses améliorations afin de renforcer le mécanisme de sérialisation Parcel Voici la présentation de l'équipe Android Security and Privacy sur les améliorations apportées C'est excellent, cela élimine ou rend inexploitables de nombreuses vulnérabilités. Ils décrivent...

BadParcel

BadParcel См. Bundle Fengshui для подробного разбора этого класса уязвимостей. Этот репозиторий содержит PoC для CVE-2023-20963 — несоответствие в логике parcel/unparcel Android WorkSource. Уязвимость исправлена в бюллетене безопасности Android за март 2023 года. Эксплойт должен работать на...

-CVE-2025-55182

🔍 GitHub CVE Scanner - 사용 가이드 React 및 Next.js 프로젝트에서 알려진 취약점을 찾기 위해 GitHub 저장소를 스캔하는 스크립트입니다. 📋 감지된 취약점 스캐너는 다음 CVE를 확인합니다: CVE-2025-55182 : React Server Components의 취약점 영향: React 19.0.0, 19.1.0, 19.1.1, 19.2.0 수정된 버전: 19.0.1, 19.1.2, 19.2.1 확인된 패키지: react, react-dom, react-server-dom-webpack,...

Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

Next.js RSC RCE 스캐너 Burp Suite 확장 Next.js / React Server Components RSC 원격 코드 실행 취약점 CVE-2025-55182 및 CVE-2025-66478을 탐지하는 고신뢰도 Burp Suite 확장입니다. 이 확장은 Searchlight Cyber 보안 연구팀이 발견한 탐지 로직을 구현합니다. RSC 스트림 내에서 undefined 객체에 대한 속성 접근 충돌을 유발하도록 특정 형태의 잘못된 multipart 요청을 전송합니다. 취약점 상세 CVE ID:...

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

The vulnerability CVE-2026-44907 is a Denial of Service affecting React server-side rendering components. An attacker can trigger high CPU usage by sending specially crafted HTTP requests to server function endpoints in affected packages: react-server-dom-webpack, react-server-dom-parcel, and rea...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

EUVD-2026-39188

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702 InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-9702

The CVE concerns the InPost PL WordPress plugin (before 1.9.1) failing to verify that a request to update the WooCommerce order parcel-locker destination originates from the legitimate buyer. This allows unauthenticated attackers to silently redirect the shipping destination of any pending or pro...

CVE-2026-9607

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-9607

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-9607 itsourcecode Courier Management System parcel_list.php sql injection

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-9607 itsourcecode Courier Management System parcel_list.php sql injection

A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public...