CVE-2025-55182-analysis

I. Vulnerability Overview In the past couple of days, there has been widespread discussion about a deserialization RCE vulnerability in React. The official CVSS score is a full 10.0, on par with Log4j. Rumors quickly spread claiming it is the "Log4j of modern frontend," causing panic among...

CVE-2025-61882-Oracle-BI-Publisher-RCE

Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

CVE-2025-8110-Gogs-Remote-Code-Execution

Affected Software: Gogs self‑hosted Git service versions prior to 0.13.0. Vulnerability Type: Command injection in the Git hook mechanism. Description: An attacker with push access to a repository can craft a malicious Git hook that injects commands into the post‑receive hook script, leading to...

CVE-2026-108571 Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

EUVD-2026-96877

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-108571

A SQL injection vulnerability exists in Xinhu Rainrock RockOA versions up to 2.7.6 . The flaw is located within the kqjcmdModel::returnchuli function in the webmain/task/openapi/openkqjAction.php file of the Openkqj Action component. Attackers can exploit this by manipulating the ID argument to p...

CVE-2025-55182-React2Shell-Exploit

Next.js React2Shell CVE-2025-55182 Expl0it A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION LEGAL USE ONLY : Use exclusively against systems you...

CVE-2025-55182

CVE-2025-55182 - React2Shell React Server Components / Next.js Pre-Authentication Remote Code Execution Property| Value ---|--- CVE ID| CVE-2025-55182 CVSS| 10.0 Critical CWE| CWE-502: Deserialization of Untrusted Data Type| Pre-Auth RCE Affected Versions Component| Affected Versions ---|--- Reac...

log4j-log4shell-playground

About A playground for poking at the critical log4j aka Log4Shell CVE-2021-44228 vulnerability mitigations. This particular problem lies within the JndiLookup feature and the log4j ability to interpret ALL the arguments of a logging call. I would expect it to only interpret the format message the...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Blind SQL Injection to Remote Code Execution Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 Vulnerability Overview CVE-2026-57517 is a critical pre-authentication blind SQL injection in Control Web Panel CWP versions ≤ 0.9.8.1224. The...

CVE-2024-54085

CVE-2024-54085: Critical Authentication Bypass Vulnerability in AMI MegaRAC BMC Affected Systems The vulnerability affects a wide range of server hardware from major manufacturers: AMI MegaRAC SPx : versions 12.x up to 12.7 and 13.x up to 13.5 HPE Cray XD670 : versions 1.09, 1.13, 1.17 Asus...

CVE-2020-15778

CVE-2020-15778 Introduction This repo reproduces CVE-2020-15778. Steps 1. Build the docker images for scp server and client cd client docker build -t client-cve . cd server docker build -t server-cve . 2. Spin up the scp server in container. docker run -d -P --name scp-server server-cve Retrieve...

CVE-2023-43177

CVE-2023-43177 CrushFTP = 10.5.1 Remote Code Execution This repository holds the proof-of-concept RCE exploit developed during research...

EUVD-2026-96876

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special...

CVE-2026-108570

A security flaw exists in the Furion .NET Framework (up to version 4.9.9.95) within the View Engine component. Specifically, the RunCompile function in the file framework/Furion/ViewEngine/Engines/ViewEngine.cs fails to properly neutralize special elements used in the template engine when process...

CVE-2026-108570 Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special...

CVE-2020-8254

CVE-2020-8254: Zip Slip in Pulse Secure VPN Windows Client A vulnerability in the Pulse Secure Desktop Client 9.1R9 has Remote Code Execution RCE if users can be convinced to connect to a malicious server. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here...

CVE-2025-31324

Proof of Concept - CVE-2025-31324 [email protected] Proof of concept exploit for vulnerability CVE-2025-31324 in SAP NetWeaver Visual Composer , which allows arbitrary file upload without authentication via the /developmentserver/metadatauploader endpoint. ⚠️ This code is for educational...

CVE-2018-7600

POC of CVE-2018-7600 Drupal RCE CVE-2018-7600 Dont Forget to Put Your Adress into the Script ! Description: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which...