777 matches found
BadParcel
BadParcel See Bundle Fengshui for a deep dive on this bug class. This repository contains PoC for CVE-2023-20963, which is mismatch in the Android WorkSource parcel/unparcel logic. The vulnerability is patched on Android's Security Bulletin of March 2023. The exploit should work on devices on AOS...
ResourcePoison
Fix for this issue has appeared as CVE-2025-22441: bulletin patch follow up Passing ApplicationInfo around ApplicationInfo is structure defining various information about installed app, most notably path to apk file from which resources and code are loaded Usually it is passed from system to...
Next.js-RSC-RCE-Scanner-Burp-Suite-Extension
Next.js RSC RCE Scanner Burp Suite Extension A high-fidelity Burp Suite extension to detect the Next.js / React Server Components RSC Remote Code Execution vulnerability CVE-2025-55182 & CVE-2025-66478. This extension implements the detection logic discovered by the Searchlight Cyber Security...
ThisSeemsWrong
Fix for this issue appeared as CVE-2024-49746: bulletin, patch "This seems wrong" Above title is the comment from Parcel::continueWrite method, which is actually responsible for resizing Parcel objects, either when explicitly request by user for example through setDataSize or when calling one of...
ReparcelBug
Android writeToParcel/createFromParcel mismatch bug PoC See https://github.com/michalbednarski/IntentsLab/issues/2issuecomment-344365482 for description of bug. This repositiory contains PoC for CVE-2017-0806, which is mismatch in GateKeeperResponse class...
CVE-2015-1474_poc
This code is ment to be a tentative of a poc for CVE-2015-1474. The code is based on the code of the screencap comand, but generates a rogue parcel that crashes the surfaceflinger when it is deserialized. See more at...
LeakValue
Android 13 introduces many enhancements in order to harden Parcel serialization mechanism Here's presentation from Android Security and Privacy team on enhancements made That is great, definitely eliminates or makes unexploitable many vulnerabilities. Also they describe breaking my previous...
CVE-2017-13286
CVE-2017-13286 CVE-2017-13286 Poccannot use All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code public void...
ReparcelBug2
CVE-2021-0928, writeToParcel/createFromParcel serialization mismatch in android.hardware.camera2.params.OutputConfiguration This is exploit using that vulnerability for privilege escalation from installed Android app into Android Settings app or any other app installed app could send to declared ...
-CVE-2025-55182
🔍 GitHub CVE Scanner - Usage Guide Script to scan GitHub repositories for known vulnerabilities in React and Next.js projects. 📋 Detected Vulnerabilities The scanner checks the following CVEs: CVE-2025-55182 : Vulnerability in React Server Components Affects: React 19.0.0, 19.1.0, 19.1.1, 19.2.0...
CLSA-2026-1792251863 TuxCare security update for react-server-dom-parcel (4 CVEs)
TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...
react2shell-scanner
react2shell-scanner Triage scanner for CVE-2025-55182 R...
Exploit for Improper Authorization in Vercel Next.Js
React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...
CVE-2026-93580
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
WordPress InPost PL plugin < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking vulnerability
Unauthenticated WooCommerce Order Parcel-Locker Hijacking vulnerability discovered by Pedro Pinho in WordPress Plugin InPost PL versions 1.9.1...
Exploit for Integer Overflow or Wraparound in Google Android
CVE-2025-48595 — Android Framework Integer Overflow Vulnerabil...
kudaf-jupyter-server-extension (>=0.2.0, <=0.3.0), parcel-data-collector (0.1.0) +1 more potentially affected by CVE-2026-73415 via jupyterlab (3.6.5)
jupyterlab PYPI version 3.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - kudaf-jupyter-server-extension =0.2.0, =0.1.0, =1.2.0 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...
