React2Shell-CVE-2025-55182-original-poc

Original PoCs for CVE-2025-55182 As public PoCs are circulating and Google's Scanner uses a variation of my original submitted PoC, it's finally a responsible time to share my original PoCs for React2Shell. This repository contains 3 PoCs: 00-very-first-rce-poc - the very first PoC I managed to...

CVE-2021-44906

CVE-2021-44906 Originally from: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip Run npm run hack And you will see the any function's done property is changed to true. The explanation of command line node index.js --.concat.constructor.prototype.done true:...

drupalgeddon2-CVE-2018-7600

Drupal - Drupalgeddon2 CVE 2018-7600 $ python3 drupalgeddon.py -h + drupalgeddon2 CVE-2018-7600 exploit by Rafael Caria usage: drupalgeddon.py -h --url URL --command COMMAND --function FUNCTION --test --proxy PROXY ! This script exploits CVE-2018-7600 a Drupal property injection in the Forms API...

PT-2026-132791

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description The forge.http client stores cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server can exploit this by using the cookie name proto to write an...

WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Prototype-Chain Property Injection

Description WordPress does not restrict Interactivity API property lookups to safe own properties in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the content is...

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Impact When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of proto resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column ...

GHSA-C75X-9X9H-28RM Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Impact When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of proto resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column ...

CVE-2026-118250

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...

InterSystems IRIS FolderManager Property Injection RCE

InterSystems IRIS FolderManager Property Injection RCE """InterSystems IRIS FolderManager Property Injection RCE""" from future import annotations from kittysploit import from lib.exploit.handler import Handler from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse...

InterSystems IRIS FolderManager Property Injection RCE — Detect

Fingerprint / reachability check for InterSystems IRIS FolderManager Property Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for InterSystems IRIS FolderManager Property Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CLSA-2026-1792174065 libinput: Fix of CVE-2026-50292

CVE-2026-50292: sanitize phys sysattr to prevent udev property injection...

CLSA-2026-1792170117 libinput: Fix of CVE-2026-50292

CVE-2026-50292: sanitize phys sysattr to prevent udev property injection...

Updated roundcubemail package fixes security vulnerabilities

Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai Fix CSS property injection via body background attribute, reported by zenithhostingevan Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo Fix email header...

MGASA-2026-0507 Updated roundcubemail package fixes security vulnerabilities

Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai Fix CSS property injection via body background attribute, reported by zenithhostingevan Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo Fix email header...

Kibana 6.5.4 Timelion Prototype Pollution

Kibana version 6.5.4 contains a Timelion prototype pollution flaw that may allow command execution. This proof of concept provides a vulnerable Docker environment and reproduction details. https://packetstorm.news/download/235002...

Apache Avatica 1.29.0 JDBC Connection Property Injection

Summary Avatica is a framework for building database drivers. Avatica is defined by a wire API between a client and a server. The Avatica server is an HTTP server, the Avatica client is a JDBC driver, and the wire API is defined by JSON or Protobuf Buffers. The flexibility of the wire API and HTT...

Apache Avatica 1.29.0 JDBC Connection Property Injection

Apache Calcite Avatica versions 1.29.0 and 1.28.0 copy unauthenticated client-supplied JDBC connection properties into backend connections. The included proof of concept injects properties that may enable local file disclosure or deserialization under specific backend conditions. !/usr/bin/env...

[SECURITY] [DSA 6545-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6545-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by supplying a crafted map key during deserialization, potentially leading to arbitrary property injection or alteration of applicatio...